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RP D OR ER 
COMMISSIONER"S MESSAGE 


I was appointed Commissioner of the Communications Security 
Establishment on June 18, 2010. I knew very little about the challenge 
that awaited me. I knew that I was following in the footsteps of 
illustrious colleagues whom I had the privilege of knowing during my 
career (Chief Justices Bisson and Lamer, and Judges Gonthier and 
Cory). I knew that I would be involved in the highly technical and 
fascinating, albeit sensitive field, of security and the protection of the 
privacy of Canadians. As a lawyer and a Federal Court of Appeal judge, 
I had been involved in a number of privacy and terrorism cases. 
However, I would never have imagined the extent of the activities of the 
Communications Security Establishment Canada (CSEC), nor the 
critical and active role played by the Office of the Commissioner. 


First, I wish to acknowledge the warm welcome that I received from the 
Office’s team. I say “team” because they are a group of people who 
work together in a remarkable spirit of cooperation and strength of mind 
and of purpose. I especially appreciated the efforts that were made as 
soon as I arrived to explain to me in a clear and understandable manner 
the mandates and roles of the Office and of CSEC respectively. In this 
regard, I would also like to thank CSEC and its Chief, John Adams, who 
took considerable time and effort to convey the full nature and scope of 
CSEC’s work. The information sessions that they organized for me were 
complex and intense, and I must say, well adapted to my needs. 


During the first nine months of my mandate, I was impressed by the 
professionalism, objectivity, and rigour of my analysts. They know they 
have an important mission, especially in ensuring that the unintentional 
interception by CSEC of the private communications of Canadians is in 
compliance with the law. Consequently they leave no stone unturned in 
their reviews, which are conducted in an impressively detailed and 
comprehensive manner. 
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I was also impressed, and I must say surprised, because I was initially 
sceptical in this regard, with the degree of transparency and spirit of 
cooperation displayed by CSEC and its Chief. There have been, and will 
be, of course, significant differences of opinion between my office and 
CSEC on certain issues. However, overall, I can say that the protection 
of the privacy of Canadians is, in the eyes of CSEC and its employees, a 
genuine concern, which is more than I would have imagined at the 
beginning of my mandate. 


During my appearance before the House of Commons’ Standing 
Committee on National Defence on November 18, 2010, I stated in the 
following terms the dilemma faced by Parliament when passing the 
Anti-Terrorism Act in December 2001: 


Within Canada, every individual has a quasi-constitutional right 
with respect to his or her privacy. And every person has a 
constitutional right with respect to security of the person. In 
addition, the State has an obligation to protect each of these 
individual rights and to ensure the country’s security as well. 
These rights and obligations are not easy to reconcile: what in 
fact would the right to privacy mean — or the right to security of 
the person — in a society where security was no longer taken for 
granted or that was no longer free and democratic? 


[ must reconcile these rights and obligations in the very specific context 
of the activities in which CSEC is engaged. It should be recalled that the 
first mandate of CSEC is to gather intelligence from foreign entities 
located outside Canada. CSEC is in fact prohibited by its governing 
legislation from “spying” on a Canadian wherever he or she might be in 
the world or on any individual in Canada. It is only unintentionally — 
and I would add unavoidable given the complexity, pervasiveness and 
interconnectedness of global telecommunications networks — that 
private communications are intercepted by CSEC. It is precisely because 
of this inevitability that the National Defence Act provides for 
ministerial authorization. The number of these intercepts, I hasten to 
emphasize, is very small. 
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During my first several months as Commissioner, I took the initiative to 
meet with the Minister of National Defence, the Chief of CSEC, the 
National Security Advisor to the Prime Minister, the Security 
Intelligence Review Committee, the Inspector General of the Canadian 
Security Intelligence Service, the Privacy Commissioner, and the interim 
Chair of the Commission for Public Complaints against the Royal 
Canadian Mounted Police. These meetings enabled me to gain a better 
appreciation not only of the scale of review activities in Canada but also 
of the opportunity for greater contact among the various review 
agencies. 


Before explaining my role, I’d like to provide the reader with a clear 
understanding of CSEC’s mandate. 


MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT CANADA 


The Anti-Terrorism Act came into effect in December 2001, adding Part 
V.1 of the National Defence Act, and setting out CSEC’s three-part 
mandate: 


Part (a) authorizes CSEC to collect foreign intelligence in 
accordance with the Government of Canada’s intelligence 
priorities; 


Part (b) authorizes CSEC to help protect electronic information 
and information infrastructures of importance to the 
Government of Canada; and 


Part (c) authorizes CSEC to provide technical and operational 
help to federal law enforcement and security agencies, including 
obtaining and understanding communications collected under 
those agencies’ own authorities. 
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The activities listed under parts (a) and (b) of CSEC’s mandate are 
subject to three legislative limitations aimed at protecting Canadians’ 


privacy: 


CSEC is prohibited from 


directing its activities at 
Canadians - wherever 
they might be in the 
world - or at any person 
in Canada. 


CSEC is prohibited by law from directing its 
activities at Canadians — wherever they might be 
in the world — or at any person in Canada; 


In conducting foreign intelligence or information 
technology security activities, CSEC may 
unintentionally intercept a one-end Canadian 
communication which is a private communication 
as defined by the Criminal Code. CSEC may use 
and retain this information only if it is essential to 
either international affairs, defence or security, or 
to identify, isolate or prevent harm to 
Government computer systems or networks; and 


To provide a formal framework for the 
unintentional interception of private 
communications, the National Defence Act 
requires express authorization by the Minister of 
National Defence once he or she is satisfied 

that specific conditions provided for in the 
National Defence Act have been met. These are 
known as ministerial authorizations. 


In providing assistance under part (c) of its mandate, CSEC is subject to 
the same laws and limitations that govern the agencies it is assisting. 


Annex A contains text of relevant sections of the National Defence Act 
relating to the role and mandate of CSEC. (p. 33) 
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MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT COMMISSIONER 


My mandate under the National Defence Act consists of three key 
functions: 


1. reviewing CSEC activities to ensure they comply with the law; 


2. conducting any investigations I deem necessary in response 
to complaints about CSEC; and 


3. informing the Minister of National Defence and the 
Attorney General of Canada of any CSEC activities that I 
believe may not be in compliance with the law. 


I also have a mandate under the Security of Information Act to receive 
information from persons who are permanently bound to secrecy 
seeking to release special operational information on the grounds that 
it is in the public interest. To date, no such matters have been reported 
to a Commissioner. 


Within the context of CSEC’s mandate, the purpose of my reviews 1s: 


¢ to ensure that activities conducted by CSEC under ministerial 
authorization are those authorized by the Minister of National 
Defence; 


* to ensure that CSEC complies with the law and only directs its 
activities at foreign entities located outside Canada; 


¢ to ensure that, in all the activities CSEC undertakes, it effectively 
applies satisfactory measures to protect the privacy of Canadians; and 


¢ to report the results of my reviews to the Minister of National 
Defence, who is responsible for CSEC. 


mme ) 


Additionally, each year I am required to submit a report to the 
Minister of National Defence on my activities, which the Minister 
must then table in Parliament. 


While I am mandated to report to the Minister, 


My office is an my office is independent and separate from the 
autonomous agency with Department of National Defence. My strong review 
its own appropriation mandate reflects the powers I have under the 


: Inquiries Act as well as the independent nature of 
from Parliament. re Bie: 
my office, which is an autonomous agency with its 


own appropriation from Parliament. 


Annex B contains the text of the relevant sections of the 

National Defence Act and the Security of Information Act relating to 
my role and mandate as CSE Commissioner (p. 35) and Annex C 
describes the history of the Office of the CSE Commissioner. (p. 37) 
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COMMISSIONER'"S OFFICE 


I am supported in my work by a staff of eight, together with a number 
of subject-matter experts, under contract, as required. In 2010-2011, 
my office’s expenditures were $1,605,422, which is within the allocated 
appropriation from Parliament. 


Annex D provides the 2010-2011 Statement of Expenditures for the Office 
of the Communications Security Establishment Commissioner. (p. 39) 


Objective of Review 
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is to enable me to provide to the Minister of National Rigorous review enables 
Defence, and indeed to all Canadians, assurance that me fo provide the 


CSEC is complying with the law and protecting the Minister assurance that 


CSEC is complying with 


privacy of Canadians. If I find an instance where 
CSEC has not complied with the law, I am obliged to 
inform the Minister of National Defence and the the law. 
Attorney General of Canada. 


Selection of activities for review 

CSEC activities are selected for review and prioritized using a set of 
detailed criteria to help determine where risk is greatest for potential 
non-compliance with the law and for risks to privacy. 


Selection and prioritization of subjects for review are documented in my 


three-year work plan, which is updated regularly as part of an ongoing 
process of assessing risk. 


Risk is assessed by considering, among other factors: 


the controls placed on the activity to ensure compliance with legal, 
ministerial and policy requirements; 


whether the activity involves private communications or information 
about Canadians; 


whether the activity is new or how much time has passed since the 
last in-depth review of an activity; 


whether there have been significant changes to the authorities or 
technologies relating to the activity; 


whether Commissioners have made findings or recommendations 
relating to the activity which require follow-up; and 


issues arising in the public domain. 


Review methodology and criteria 


In conducting a review, my staff examine CSEC’s 
written and electronic records, including CSEC’s 
policies and procedures and legal advice received 
from Justice Canada. My staff request briefings and 


My staff test fhe contents demonstrations of specific activities, interview 
of CSEC’s databases. managers and employees and observe firsthand 


CSEC operators and analysts to verify how they 
conduct their work. My staff test information 
obtained against the contents of systems and 
databases. The work of CSEC’s internal auditors and 
evaluators may also inform reviews. 


Each review includes an assessment of CSEC’s activities against a 


standard set of criteria, described below, consisting of legal 


requirements, ministerial requirements, and policies and procedures. 


Other criteria may be added, as appropriate. 
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Legal requirements: I expect CSEC to conduct its activities in 
accordance with the National Defence Act, the Privacy Act, the 
Criminal Code, the Canadian Charter of Rights and Freedoms 
and any other relevant legislation, and in accordance with 
Justice Canada advice. 


Ministerial requirements: I expect CSEC to conduct its 
activities in accordance with ministerial direction, following all 
requirements and limitations set out in a ministerial 
authorization or directive. 


Policies and procedures: I expect CSEC to have appropriate 
policies and procedures in place to guide its activities and to 
provide sufficient direction on legal and ministerial 
requirements and the protection of Canadians’ privacy. I expect 
employees to be knowledgeable about and comply with policies 
and procedures. I also expect CSEC to employ an effective 
management control framework to ensure that the integrity and 
lawful compliance of its activities is maintained. This includes 
appropriate accounting for decisions taken and for information 
relating to compliance and the protection of the privacy of 
Canadians. 


My review reports contain findings that confirm whether the above- 
noted criteria have been satisfactorily met by CSEC. These reports may 
also disclose the nature and significance of deviations from these 
criteria. In some cases, I make recommendations to the Minister which 
are aimed at correcting discrepancies between CSEC’s activities and the 
expectations established by the review criteria. | monitor CSEC’s efforts 
to address recommendations and respond to negative findings. As well, 
I monitor areas for follow-up identified in past reviews. 


The Logic Model in Annex E provides a flow chart of our comprehensive 
review program. (p. 41) 
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Recommendations 

Since 1997, my predecessors and I have submitted to the Minister of 
National Defence a total of 61 classified review reports and studies. In 
total, the reports contain 133 recommendations. CSEC has accepted and 
implemented or is working to address 95 percent (122 out of 129) of 
these recommendations. I am awaiting the Minister’s response to the 
four recommendations I made in 2010-2011. This past year, CSEC 
completed work in response to three past recommendations and I am 
monitoring 18 recommendations that CSEC is working to address. 


On occasion, CSEC may reject one of my recommendations. In this 
instance, I assess the reasons provided, in order to determine whether to 
accept them or to pursue the issue. 


See Annex F for a complete list of the 61 classified review reports and 
studies submitted to the Minister of National Defence. (p. 43) 
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OVERVIEW OF 2010-2011 FINDINGS AND 
RECOMMENDATIONS 


During the 2010-2011 reporting year, I submitted six reports to the 
Minister of National Defence on my review of CSEC activities. 


These reviews were conducted under two areas of my mandate: 


¢ ensuring CSEC activities are in compliance with the law — as set out 
in paragraph 273.63(2)(a) of the National Defence Act; and 


¢ ensuring CSEC activities under a ministerial authorization are 
authorized — as set out in subsection 273.65(8) of the 
National Defence Act. 


One review, which is now being done on an annual basis, related to 
disclosures of information about Canadians to Government of Canada 
departments and agencies. This review permits me to closely monitor 
CSEC activities involving Canadian identity information. Performing 
this review yearly allows me to verify that CSEC complies with the law 
and maintains measures to protect the privacy of Canadians. 


Two reviews were conducted of CSEC information technology security 
activities conducted under ministerial authorizations. 


Three reviews related to foreign signals intelligence activities, and 
included a review of how CSEC determines that entities of foreign 
intelligence interest are foreign entities located outside of Canada, as 
required by the National Defence Act. 


2010-2011 es 11 


EE | 


The results 
Overall, I am able to report that the activities of CSEC examined this 
year complied with the law. 


My reviews in 2010-2011 also demonstrate that: 


+ CSEC takes seriously and acts on the Commissioner’s 
recommendations. Over the past year CSEC addressed a number of 
deficiencies identified in previous reviews. My follow-up of these 
recommendations determined that CSEC addressed these deficiencies; 


¢ CSEC continued important work to incorporate 
The activities of CSEC information management practices into its core 


examined this year programs and has made it part of its employees’ 


complied with the law. daily activities. This is Teele Me Sn 
CSEC to demonstrate accountability for its 


activities and decisions; and 


* CSEC has mature management, governance and internal oversight 
structures to guide and direct its operational activities. 


In total this past year, I made four recommendations, two of which 
relate to reporting information to the Minister of National Defence 
with the objective of providing the Minister with a more complete 
picture of communications CSEC unintentionally intercepts and 
involving Canadians or persons in Canada. The other two 
recommendations strengthen policy guidance for certain foreign 
signals intelligence activities. 


CSEC takes seriously 
and acts on the 
Commissioner's 
recommendations. 
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Past reviews of CSEC activities under ministerial authorizations have 
consistently demonstrated that the proportion of private communications 
that CSEC unintentionally intercepts is very small. Nevertheless, should 
there be an instance of non-compliance involving 

private communications, the potential impact on the 

privacy of Canadians could be significant, which is 


why I continue to focus my attention on this : : 
y ” The proportion of private 


communications that 


See Annex G for information on legislative CSEC unintentionally 


safeguards for private communications and intercepts is very small. 
information about Canadians. (p. 47) 


particular activity. 
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HIGHLIGHTS OF THE SIX REVIEW REPORTS 
SUBMITTED TO THE MINISTER IN 2010-2011 


1. Review of CSEC information technology 
security activities conducted under 
ministerial authorization (Activity 1) 


Background 

The National Defence Act mandates CSEC to provide advice, guidance 
and services to help ensure the protection of electronic information and of 
information infrastructures of importance to the Government of Canada. 


This review examined certain information technology security activities 
conducted by CSEC under ministerial authorization in 2008-2009 at two 
Government of Canada departments. The activities examined help 
protect computer systems by detecting, analyzing, and mitigating 
sophisticated cyber attacks aimed at covertly accessing sensitive 
government computer networks. 


My review followed-up on an operational issue that came to light in late 
2006 and which had the potential for non-compliance. The 
Commissioner’s 2007-2008 Annual Report commended the Chief of 
CSEC for his handling of this issue and for keeping the Commissioner 
informed of corrective steps. 


The review also included an examination of CSEC’s responses to the 
findings and recommendations of a previous review of information 
technology security activities at a specific Government of Canada 
department. These previous findings and recommendations related to 
ambiguities in policy, corporate record keeping and CSEC employees’ 
awareness of their responsibilities for the activities. My review included 
examining a 2007 CSEC internal audit report relating to these activities. 
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Review rationale 

Specific controls are placed on these information technology security 
activities to ensure they comply with legal, ministerial and policy 
requirements. Major changes to certain practices and to CSEC’s policies 
and procedures relating to these activities recently occurred. This is the 
first review since CSEC restructured these activities. Past Commissioners 
have also made findings and recommendations on these activities. 


Findings 


¢ Based on information reviewed and interviews conducted, I found 
that CSEC’s activities were authorized and carried out in accordance 
with the law, ministerial requirements, and CSEC’s policies and 
procedures. 


+ CSEC’s use and retention of unintentionally intercepted private 
communications and information about Canadians complied with the 
law and CSEC policies. 


+ Iam pleased to note that, in 2008-2009, CSEC made significant 
changes to the policies and procedures and to the accountability 
framework for these activities. I found the new policies and 
procedures to be comprehensive, containing satisfactory measures to 
protect the privacy of Canadians. 


+ CSEC also introduced processes that strengthen employee 
understanding of the compliance framework, policies and procedures. 
CSEC monitored the conduct of the activities to verify compliance with 
legal, ministerial and policy requirements, and retained a complete 
record of these activities. 


¢ Iam confident that the significant changes made to these information 
technology security activities address the previous findings and 
recommendations made in the Commissioner’s 2006 review. 
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* Finally, this review included a follow-up examination of a principal 

CSEC information technology security software tool and database. 
I confirmed an observation made last year in this office’s study of 
CSEC’s information technology security activities not conducted 
under ministerial authorization: that a software tool used by CSEC 
has adequate functionality to restrict access to information in the 
system, to meet security and confidentiality requirements, and to 
protect the privacy of Canadians. 


Recommendations 
I made no recommendations. 


2. Review of CSEC information technology 
security activities conducted under 
ministerial authorization (Activity 2) 


Background 

This review examined other information technology security activities, 
conducted for two Government of Canada departments in 2007-2008 
and 2008-2009, under ministerial authorizations pursuant to the 
National Defence Act. 


The activities at the two departments involved CSEC efforts to penetrate 
the departments’ computer systems (under controlled circumstances) to 
demonstrate potential vulnerabilities and to test the departments’ 
reactions to such attacks. 


My examination included changes to the scope of these activities and to 
the technology used by CSEC. I assessed these changes in terms of their 
potential impact on the risk to compliance with the law and on the risk 
to privacy. 
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Review rationale 

Major changes to certain practices, technologies and CSEC policies and 
procedures relating to these activities have recently occurred. Specific 
controls are placed on these activities to ensure compliance with legal, 
ministerial and policy requirements, while protecting the privacy of 
Canadians. Past Commissioners had also made findings and 
recommendations concerning these activities. This is the first review 
since CSEC restructured these activities. 


Findings 


¢ Based on information reviewed and interviews conducted, I found 
that CSEC’s activities were authorized and carried out in accordance 
with the law, ministerial requirements and CSEC policies and 
procedures. 


¢ I found that the new policies and procedures were comprehensive and 
contained satisfactory measures to protect the privacy of Canadians. 


¢ The record of the activities demonstrated that CSEC’s new 
management control framework provides strong monitoring and 
compliance validation tools, which help ensure compliance with the 
law and the protection of Canadians’ privacy. 


¢ Changes to the technology and its application by CSEC did not 
impact on the risk to compliance with the law or on the risk to 
privacy. 


Recommendations 
I made no recommendations. 
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3. Combined annual review of CSEC foreign 
signals intelligence collection activities 
conducted under ministerial authorizations 


Background 

This was the first combined annual review of all foreign signals 
intelligence collection programs. I am required by the National Defence 
Act to review activities under ministerial authorization. The 2009-2010 
Annual Report that I submitted to the Minister describes the recent 
introduction of the office’s horizontal review approach, which involves a 
thorough examination of processes common to all CSEC foreign 
intelligence collection activities under ministerial authorization. For 
example, common to all collection methods are the processes by which 
CSEC: identifies, selects and directs its activities at entities of foreign 
intelligence interest; uses, shares, reports, retains or disposes of 
intercepted information; and takes measures to protect private 
communications and information about Canadians. My review included 
examining a CSEC internal audit report relating to these activities. 


Review rationale 

The horizontal review approach led to a re-assessment of how my office 
reviews ministerial authorizations. Given that common processes are 
examined in horizontal reviews, it was determined that this combined 
annual review of foreign signals intelligence ministerial authorizations 
would focus on any significant changes and on any private 
communications unintentionally intercepted by CSEC. 


I looked for changes to the authorities and scope of the programs, to the 
technology used by CSEC, and to the associated management control 
frameworks. I assessed any changes in terms of their impact on the risk 
to compliance with the law and on the risk to privacy. 


I examined certain metrics relating to interception and the privacy of 
Canadians. The purpose was to establish a baseline of key information, 
to examine trends and to allow identification of any significant changes 
over time. These metrics will also inform the risk assessment process 
and the development of my review work plan. 
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Another objective of this review was to examine a sample of private 
communications intercepted by CSEC under foreign intelligence 
ministerial authorizations but which had not been used in CSEC 
reporting. The purpose was to assess whether this sample contained 
foreign intelligence essential to international affairs, defence or security, 
as required by the National Defence Act. 


Findings 

The extent to which I assessed CSEC’s compliance with the law was 
determined by this review’s focus on identifying and understanding 
significant changes to the foreign signals intelligence collection 
programs. 


¢ Within this context, and based on information 
reviewed and interviews conducted, I found that 
the activities were authorized under the National 
Defence Act and there was no indication of 
unlawful activity by CSEC. CSEC met ministerial 
requirements, and has effective policies and 


CSEC retained only those 
private communications 
essential to Canada's 
international affairs, 
defence, or security. 


procedures in place to guide its activities. 


¢ There are positive trends in policy development 
and in the clarity and consistency of the requests 
for ministerial authorizations. Within the overall 
amount of communications intercepted by CSEC, 
I found that the proportion of recognized private 
communications that had been unintentionally 
intercepted remained very small. 


¢ Overall, the foreign signals intelligence collection programs did not 
change significantly, and as a result, I determined that it is not 
necessary at this time to conduct an in-depth review of any of these 
programs. 


¢ With regard to the sample of private communications, based on the 
information reviewed and interviews conducted, I found that CSEC 
retained only those private communications essential to Canada’s 
international affairs, defence, or security, as required by law. 
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Recommendations 

I made three recommendations. Two of the recommendations dealt with 
reporting to the Minister of National Defence certain information 
relating to privacy, and including in the ministerial authorizations a 
requirement to report this information. This information is necessary to 
provide the Minister with a complete picture of CSEC’s collection 
activities and to support the Minister in his accountability for CSEC, 
including for the measures CSEC takes to protect the privacy of 
Canadians. 


I also recommended that, given the importance of ensuring legal 
compliance and the protection of Canadians’ privacy, CSEC should 
accelerate the timeline for implementation of an improved policy for the 
active monitoring of activities under foreign signals intelligence 
ministerial authorizations. 


As of the end of the 2010-2011 reporting period, March 31, 2011, I am 
awaiting the Minister’s response to these recommendations and will note 
them in next year’s annual report. 


4. Review of CSEC activities carried out under a 
ministerial directive and used by CSEC to 
identify new foreign entities believed to be of 
foreign intelligence interest 


Background 

The National Defence Act mandates CSEC to acquire and use 
information from the global information infrastructure for the purpose of 
providing foreign intelligence, in accordance with Government of 
Canada intelligence priorities. 


CSEC conducts a number of activities for the purposes of locating new 


sources of foreign intelligence. When other means have been exhausted, 
CSEC may use information about Canadians when it has reasonable 
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grounds to believe that using this information may assist in identifying 
and obtaining foreign intelligence. CSEC conducts these activities 
infrequently, but they can be a valuable tool in meeting Government of 
Canada intelligence priorities. CSEC does not require a ministerial 
authorization to conduct these activities because they do not involve 
interception of private communications. However, a ministerial directive 
provides guidance on the conduct of these activities. 


In recent years, three reviews have involved some degree of examination 
of these activities: a Review of CSEC’s foreign intelligence collection in 
support of the Royal Canadian Mounted Police (RCMP) (Phase II) (2006); 
a Review of CSEC’s activities carried out under a (different) ministerial 
directive (2008); and a Review of CSEC’s support to the Canadian 
Security Intelligence Service (CSIS) (2008). 


In his 2006-2007 Annual Report, the late Commissioner Gonthier 
questioned whether the foreign signals intelligence part of CSEC’s 
mandate (part (a) of its mandate) was the appropriate authority in all 
instances for CSEC to provide support to the RCMP in the pursuit of its 
domestic criminal investigations. In his 2007-2008 Annual Report, 
Commissioner Gonthier stated that pending a re-examination of the legal 
issues raised, no assessment would be made of the lawfulness of CSEC’s 
activities in support of the RCMP under the foreign signals intelligence 
part of CSEC’s mandate. He also noted that CSEC’s support to CSIS 
raised similar issues. Commissioner Gonthier emphasized that although 
he was in agreement with the advice that the Department of Justice had 
provided to CSEC, he questioned which part of CSEC’s mandate — part 
(a) or part (c), the assistance part of CSEC’s mandate — should be used 
as the proper authority for conducting the activities. 


Subsequent to these reviews and statements in the annual reports, the 
Chief of CSEC suspended these activities. CSEC then made significant 
changes to related policies, procedures and practices. 
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Review rationale 
These activities involve CSEC’s use and analysis of information about 


Canadians for foreign intelligence purposes. Specific controls are placed 


on these activities to ensure compliance with legal, ministerial and policy 


requirements. Major changes to certain policies, procedures and practices 


have recently occurred. This was the first review of these activities since 


the Chief of CSEC allowed their resumption under new policies and 


procedures. There were also related issues, findings and recommendations 


highlighted by my predecessors that required follow-up. 


Findings 
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Based on information reviewed and interviews conducted, I found 
that CSEC’s activities were authorized and carried out in accordance 
with the law, ministerial requirements and CSEC’s policies and 
procedures. 


I found that the new policies and procedures were comprehensive and 
contained satisfactory measures to protect the privacy of Canadians. 


Because of the significant changes made by CSEC to these activities 
and the positive results of this review, I am of the view that CSEC has 
addressed the previous findings and recommendations. 


I assessed that the new processes put in place by CSEC were 
consistent with part (a) of its mandate. I had no questions similar to 
those raised in previous years as to whether such activities would be 
more appropriately authorized under part (c) of CSEC’s mandate. 


CSEC’s new policies, guidelines and forms address findings and 
recommendations made by past Commissioners. CSEC managers and 
officials were knowledgeable about and complied with policies and 
procedures. CSEC managers routinely and closely monitored these 
activities to ensure they complied with the governing authorities. 
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Recommendations 

I made no recommendations. However, given that these activities 
involve CSEC’s use and analysis of information about Canadians, and 
therefore have the potential to affect their privacy, I have directed my 
office to monitor these activities to ensure they continue to be conducted 
in accordance with the law, ministerial requirements and CSEC’s 
policies and procedures. 


5. Review of the process by which CSEC 
determines that entities of foreign 
intelligence interest are foreign entities 
located outside of Canada, as required by 
the National Defence Act 


Background 

CSEC must also be able to identify those one-end Canadian private 
communications it can lawfully intercept under a ministerial 
authorization on the basis that the acquisition of these communications is 
unintentional and the interception is directed at a foreign entity located 
outside Canada. This process must contain measures to protect the 
privacy of Canadians. 


For the period of September 2008 to December 2010, I examined and 
tested the process and practices by which CSEC determines that 
entities of foreign intelligence interest are foreign entities located 
outside of Canada. 


Review rationale 

These activities are the foundation of CSEC’s foreign signals 
intelligence collection programs. Specific controls are placed on these 
activities to ensure they meet the legal, ministerial and policy 
requirements which are crucial to protecting Canadians’ privacy. 
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Past Commissioners made findings and recommendations on these 
activities, which required follow-up. In addition, major changes to 
certain technologies and policies and procedures relating to these 
activities have recently occurred and others are in progress. This is one 
of the first in-depth horizontal reviews of a CSEC process common to all 
foreign intelligence collection methods. 


Findings 


¢ Based on information reviewed and interviews conducted, I found 
that the process by which CSEC determines that entities of foreign 
intelligence interest are foreign entities located outside of Canada is in 
accordance with the law, ministerial requirements, and CSEC’s 
policies and procedures. 


+ CSEC has sufficient policies and processes to satisfy the legal 
requirement not to direct foreign signals intelligence interception 
activities at a Canadian (anywhere) or at any person in Canada. 


+ CSEC employees who were interviewed and observed in their work 
were knowledgeable about relevant policies and procedures and were 
applying them in the conduct of the activities. CSEC managers 
routinely and closely monitor the activities to ensure they comply 
with governing authorities. 


+ CSEC takes measures in the design of associated 
CSEC takes measures in systems and databases to promote compliance 


the design of its systems to with the law and the protection of Canadians’ 

‘ : privacy. I found that recent enhancements to these 

promote compliance with me ; 
; systems and databases assist in ensuring 

the law and the protection compliance with the law, ministerial requirements 

of Canadians’ privacy. and policy. Additional planned enhancements will 


further improve compliance. 


¢ I did find, however, certain deficiencies in some 
of the associated management systems and 
databases. I am pleased to note that CSEC is 
taking measures to address these deficiencies. 
I will monitor CSEC’s efforts in this regard. 
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Recommendations 

CSEC’s policies and procedures generally provide sufficient direction to 
CSEC employees in protecting Canadians’ privacy while determining that 
entities of foreign intelligence interest are foreign entities located outside 
of Canada. However, policies and procedures applicable to a certain 
foreign signals intelligence collection program provide only limited 
direction on the process and practices for such activities. I therefore 
recommended that CSEC provide specific guidance for these activities. 


As of the end of the reporting period, March 31, 2011, I am awaiting the 
Minister’s response to this recommendation and will note it in next 
year’s annual report. 


6. Annual review of CSEC disclosures of 
information about Canadians to 
Government of Canada clients 


Background 

This review fulfills a commitment in the 2009-2010 Annual Report to 
conduct an annual review of a sample of disclosures of information 
about Canadians to Government of Canada departments and agencies. 
The purpose is to verify that CSEC complies with the law and maintains 
measures to protect the privacy of Canadians. 


Information about Canadians may be included in CSEC’s reports if it is 
essential to understanding foreign intelligence. However, any information 
that identifies a Canadian must be suppressed in reports disseminated to 
government departments and agencies — that is, replaced by a generic 
reference such as “a named Canadian”. 


See Annex G for more detailed information on legislative safeguards for 
private communications and measures to protect information about 
Canadians. (p. 47) 
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When receiving a subsequent request for disclosure of the details of the 
suppressed information, CSEC must verify that the requesting 
government department or agency has both the authority and operational 
justification for obtaining such information. Only then may CSEC 
provide this information. 


This review encompassed a sample of approximately 20 percent of 
requests received by CSEC for disclosure of suppressed information 
about Canadians contained in foreign intelligence reports, from April to 
September 2010. The sample included disclosures made to all of the 
Government of Canada departments and agencies that requested, and 
were provided with, information about Canadians. 


My office examined the forms that CSEC used to document the 
departments’ and agencies’ authorities and justifications of their need for 
information about Canadians, as well as the associated foreign 
intelligence reports. 


Review rationale 

CSEC’s disclosure activities involve the sharing of information about 
Canadians. Should there be an instance of non-compliance while CSEC 
conducts these activities, the potential impact on the privacy of 
Canadians could be significant. 


In addition, I assessed CSEC’s activities in response to two 
recommendations in a February 2010 review report of my predecessor 
relating to: (a) providing tools to support the tracking of clients’ requests 
for, and any associated disclosures of, suppressed information about 
Canadians; and, (b) improving the consistency and accuracy of CSEC 
reports to the Minister of National Defence about these activities. 


Findings 


+ Based on information reviewed and interviews conducted, I found 
that CSEC’s disclosure of suppressed information about Canadians to 
Government of Canada clients was conducted in compliance with 
the law. 
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¢ Policies and procedures were in place to provide sufficient direction to 
CSEC employees on the protection of the privacy of Canadians. 


+ CSEC employees were knowledgeable about, and acted in accordance 
with, policies and procedures. CSEC managers monitored activities to 
ensure CSEC employees complied with governing authorities. 


¢ Iam satisfied that CSEC’s practices and the planned implementation of 
a new system will address previous recommendations and permit 
CSEC to better track and produce accurate and consistent metrics on 
these activities. 


Recommendations 

I made no recommendations but will continue to conduct an annual 
review of these activities to verify that CSEC continues to comply with 
the law and maintains measures to protect the privacy of Canadians. I 
will also monitor CSEC efforts to implement the new system. 


COMPLAINTS ABOUT CSEC’S ACTIVITIES 


My mandate includes undertaking any investigation I deem necessary in 
response to a complaint — for example to determine whether CSEC has 
engaged, or is engaging, in unlawful activity or is not taking sufficient 
measures to protect the privacy of Canadians. 


In 2010-2011, there were no complaints that warranted investigation. 


DUTY UNDER THE SECURITY OF INFORMATION ACT 


I have a duty under the Security of Information Act to receive information 
from persons who are permanently bound to secrecy seeking to defend the 
release of special operational information on the grounds that it is in the 
public interest. No such matters were reported in 2010-2011. 
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ACTIVITIES OF THE COMMISSIONER'S OFFICE 


Appearance before the Standing Committee on 
National Defence 

As I mentioned in my introduction, in November 2010 I appeared for the 
first time before the House of Commons Standing Committee on National 
Defence, which examined my nomination. I was thankful for the 
opportunity to meet with the Committee so early in my mandate, to 
describe my experiences, and to provide an overview of the legislative 
framework for CSEC and my role and activities. My remarks to the 
Committee are available on my office’s website at www.ocsec-bccst.gc.ca. 
I look forward to other opportunities to appear before this or other 
committees of Parliament to discuss my activities and findings or to 
discuss the importance of review generally. 


British Intelligence and Security Committee of 
Parliamentarians 

I met with the British Intelligence and Security Committee of 
Parliamentarians during the Committee’s visit to Ottawa in March 2011. 
Committee members and my officials and I exchanged information on 
challenges and best practices in review methodologies and compared 
differences in respective models for the review of security and 
intelligence agencies. 


Review Agencies Forum 

Since 2005, the Review Agencies Forum has brought together officials 
from my office, the Security and Intelligence Review Committee (SIRC), 
the Office of the Inspector General of the Canadian Security Intelligence 
Service, the Commission for Public Complaints against the Royal Canadian 
Mounted Police (CPC) and the Office of the Privacy Commissioner. The 
Forum met in January 2011 to discuss issues of common interest. 
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Training 

During 2010, my office developed, and in November 

delivered, a review workshop for personnel of 

organizations dedicated to the review of law My office developed 
enforcement and security and intelligence agencies. and delivered a review 
This workshop contributed to training individuals in workshop. 

these review bodies. The purpose is to enhance the 

effectiveness of independent review. Another 

workshop will be held in the fall of 2011. 


Several of my staff received training from CSEC in the use of a specific 
CSEC foreign intelligence database. I would like to express appreciation 
to CSEC for this training. 


Other activities 

In October 2010, my office participated in the annual Canadian 
Association of Security and Intelligence Studies conference in Ottawa. 
The theme of the conference was Understanding National Security. 
Leading experts from Canada and abroad provided perspectives on issues 
of importance to the security and intelligence and review communities. 


In December 2010, my office’s Executive Director and I met with the 
Privacy Commissioner of Canada and the Assistant Privacy 
Commissioner to discuss our respective roles and responsibilities. The 
Executive Director also participated in a workshop and provided input 
into the development of an Office of the Privacy Commissioner 
reference guide for government policy makers. 


In March 2011, my office’s Executive Director, along with the former 
Chair of the CPC and the Executive Director of SIRC, participated in a 
training day for Justice Canada counsel working in the field of national 
security. The panel made presentations on the importance of review of 
law enforcement and security and intelligence agencies, including 
discussion of the findings and recommendations made in the inquiries 
led by the Honourable Justices O’Connor, Iacobucci and Major. 
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WORK PLAN — REVIEWS UNDERWAY AND 
PLANNED 


The results of several reviews currently underway are expected to be 
reported on to the Minister of National Defence in the coming year and 
will be included in my 2011-2012 Annual Report. 


The subjects of these reviews include: an annual review of occurrences 
identified by CSEC in 2010 that affected or had the potential to affect 
the privacy of a Canadian, and the measures taken by CSEC to address 
them; CSEC’s foreign intelligence sharing with international partners; 
assistance to CSIS under part (c) of CSEC’s mandate and sections 12 and 
21 of the CSIS Act; and CSEC’s retention and disposal of intercepted 
information, and, in particular, of private communications and 
information about Canadians. 


Other reviews planned for 2011—2012 include: CSEC information 
technology security activities conducted under Government of Canada 
departments’ Criminal Code and Financial Administration Act 
authorities; activities conducted under CSEC information technology 
security ministerial authorizations; and particular activities of CSEC’s 
operations centre. Some reviews may carry over into 2012-2013. 


In addition, I will continue the annual reviews of foreign intelligence 
ministerial authorizations, of CSEC disclosures of information about 
Canadians to government clients, and of occurrences identified by CSEC 
that affected or had the potential to affect the privacy of a Canadian and 
the measures taken by CSEC to address them. 


In addition to briefings on activities that we plan to review, the 
Commissioner’s office requests briefings from CSEC to assist in | 
determining risk and work plan development. We receive regular briefs 
on changes to the management and administration of CSEC operational- 
related programs, including changes to policies and procedures. 


30 es ANNUAL REPORT 


THE UPCOMING YEAR 


I am beginning the second year of my mandate with optimism and 
realism. On the one hand, I am optimistic because of the quality of the 
team that assists me, the rigour of the review process established by the 
office, and the professionalism underlying relations between CSEC and 
my office. On the other hand, I am realistic given the constantly 
changing technological environment and an equally dynamic 
international environment, to which I and my team, as well as CSEC, 
must adapt. In this context, I want to ensure that 

CSEC maintains and reinforces the measures taken to 

protect the privacy of Canadians. 


Our free and democratic society will always be 


subject to internal and external threats. Each The need to reconcile the 
technological development, for example, may have right of everyone fo a free 
both positive and negative effects. The need to and democratic society 


reconcile the right of everyone to a free and 


and the right of each 


democratic society and the right of each person to the : 
person to the protection of 


protection of his or her privacy demands rigorous and 
ongoing efforts on the part of those who, like us, have his or her privacy 

a mandate to ensure that the activities of agencies demands rigorous and 
which operate in the greatest secrecy comply with ongoing efforts. 

the law and protect the privacy of Canadians. 


My office will carry out several reviews during the upcoming year. I plan 
to pay special attention to those activities of CSEC which concern me the 
most and where the risks to privacy are the greatest. I want to ensure that 
CSEC does not use or retain any private communications that are not 
related to international affairs, defence, or security, which is a legal 
requirement. I also want to ensure that the identity of a Canadian is 
revealed only when it is strictly necessary. The risk to individual privacy 1s 
heightened when information is shared, particularly with international 
partners, and I will report next year on the review under way on this issue. 


2010-2011 me 31 


a eee 


32 


The part of CSEC’s mandate dealing with the protection of information 
and the information infrastructures of importance to the Government of 
Canada has gained in prominence; recent incidents have reminded us to 
what degree our computer systems may be vulnerable. In this context, I 
have requested my officials to examine in-depth these CSEC activities of 
growing prominence to ensure that they comply with the law and protect 
the privacy of Canadians. 


A final word on an issue that persists year after year: the need for 
legislative amendments that will eliminate the ambiguities noted by my 
predecessors and myself in the National Defence Act. I know that the work 
is under way. It is my hope that the new government elected on May 2nd 
2011 will act quickly and that all Members of Parliament will support the 
elimination of these ambiguities. These legislative amendments, in my 
opinion, should not provoke any controversy. 
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ANNEX A: MANDATE OF THE CSEC — EXCERPTS FROM THE 
NATIONAL DEFENSE ACT 


The Communications Security Establishment Canada (CSEC) is the national cryptologic 
agency, providing the Government of Canada with two key services: foreign signals 
intelligence, and information technology security. CSEC also provides technical and 
operational assistance to federal law enforcement and security agencies. 


CSEC’s foreign intelligence products and services support government decision-making in 
the fields of national security, national defence and foreign policy. CSEC’s signals 
intelligence activities relate exclusively to foreign intelligence and are directed by the 
Government of Canada’s intelligence priorities. 


CSEC’s information technology security products and services enable government 
departments and agencies to secure their electronic information systems and networks. 
CSEC also conducts research and development on behalf of the Government of Canada 
in fields related to communications security. 


CSEC’s three-part mandate is set out in subsection 273.64(1) of the National Defence Act: 
(a) to aquire and use information from the global information infrastructure for 
the purpose of providing foreign intelligence, in accordance with 
Government of Canada intelligence priorities; 
(b) to provide advice, guidance and services to help ensure the protection of 
electronic information and of information infrastructures of importance to 


the Government of Canada; and 


(c) to provide technical and operational assistance to federal law enforcement 
and security agencies in the performance of their lawful duties. 


CSEC’s website is: www.cse-cst.gc.ca. 
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ANNEX B: MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT COMMISSIONER — EXCERPTS FROM THE 
NATIONAL DEFENSE ACT AND THE SECURITY OF 
INFORMATION ACT 


National Defence Act — Part V.1 


273.63 (1) 


(2 


— 


(3) 


(4) 


(5) 


The Governor in Council may appoint a supernumerary judge or a retired 
judge of a superior court as Commissioner of the Communications Security 
Establishment to hold office, during good behaviour, for a term of not more 
than five years. 


The duties of the Commissioner are: 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any 
activity of the Establishment that the Commissioner believes may not be 
in compliance with the law. 


The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner's activities and 
findings, and the Minister shall cause a copy of the report to be laid before 
each House of Parliament on any of the first 15 days on which that House is 
sitting after the Minister receives the report. 


In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the Inquiries Act. 


The Commissioner may engage the services of such legal counsel, technical 
advisers and assistants as the Commissioner considers necessary for the 
proper performance of his or her duties and, with the approval of the 
Treasury Board, may fix and pay their remuneration and expenses. 
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(6) The Commissioner shall carry out such duties and functions as are assigned 
to the Commissioner by this Part or any other Act of Parliament, and may 
carry out or engage in such other related assignments or activities as may be 
authorized by the Governor in Council. 


(7) The Commissioner of the Communications Security Establishment holding 
office immediately before the coming into force of this section shall continue 
in office for the remainder of the term for which he or she was appointed. 


ra 


273.65 (8) The Commissioner of the Communications Security Establishment shall review 
activities carried out under an authorization issued under this section to ensure 
that they are authorized and report annually to the Minister on the review. 


Security of Information Act 


15. (1) No person is guilty of an offence under section 13 or 14 if the person establishes 
that he or she acted in the public interest. [...] 


(5) A judge or court may decide whether the public interest in the disclosure 
outweighs the public interest in non-disclosure only if the person has complied 
with the following: [...] 


(5) the person has, if he or she has not received a response from the deputy head 
or the Deputy Attorney General of Canada, as the case may be, within a 
reasonable time, brought his or her concern to, and provided all relevant 
information in the person’s possession to, [...] 


(1) the Communications Security Establishment Commissioner, if the 
person’s concern relates to an alleged offence that has been, is being or 
is about to be committed by a member of the Communications Security 
Establishment, in the purported performance of that person’s duties and 
functions of service for, or on behalf of, the Communications Security 
Establishment, and he or she has not received a response from the 
Communications Security Establishment Commissioner within a 
reasonable time. 
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ANNEX C: HISTORY OF THE OFFICE OF THE 
COMMUNICATIONS SECURITY ESTABLISHMENT 
COMMISSIONER 


The Office of the Communications Security Establishment Commissioner was created on 
June 19, 1996, with the appointment of the inaugural Commissioner, the Honourable 
Claude Bisson, O.C., a former Chief Justice of Québec, who held the position until June 
2003. He was succeeded by the late Right Honourable Antonio Lamer, P.C., C.C., C.D., 
LL.D., D.U., former Chief Justice of Canada, for a term of three years. The Honourable 
Charles D. Gonthier, C.C., Q.C., who retired as Justice of the Supreme Court of Canada in 
2003, was appointed as Commissioner in August 2006, a position he held until his death in 
July 2009. The Honourable Peter deC. Cory, C.C., C.D., a former Justice of the Supreme 
Court of Canada, served as Commissioner from December 14, 2009 to March 31, 2010. On 
June 18, 2010, the Honourable Robert Décary, Q.C., a former Justice of the Federal Court 
of Appeal, was appointed Commissioner. 


For the first six years (from June 1996 to December 2001), the Commissioner carried out 
his duties under the authority of Orders in Council issued pursuant to Part II of the 
Inquiries Act. During this period, the Commissioner’s responsibilities were twofold: to 
review the activities of the Communications Security Establishment Canada (CSEC) to 
determine whether they conformed with the laws of Canada; and to receive complaints 
about CSEC’s activities. 


The omnibus Anti-terrorism Act, which came into force on December 24, 2001, introduced 
amendments to the National Defence Act by adding Part V.1 and creating legislative 
frameworks for both the Commissioner’s office and CSEC. It gave the Commissioner new 
responsibilities to review activities carried out by CSEC under a ministerial authorization. 
The legislation also continued the Commissioner’s powers under the Inquiries Act. 


The omnibus legislation also introduced the Security of Information Act, which replaced 
the Official Secrets Act. This legislation gives the Commissioner specific duties in the event 
that a person, who would otherwise be permanently bound to secrecy, seeks to defend the 
release of classified information about CSEC on the grounds that it is in the public interest. 


On April 1, 2009, the Commissioner’s office was granted its own parliamentary 
appropriation. While the Commissioner continues to provide the Minister of National 
Defence with his reports, the Commissioner’s office is separate from, and not part of, the 
Department of National Defence. 
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ANNEX D: STATEMENT OF EXPENDITURES 2010-2011 


Standard Object Summary 
Salaries and Wages 

Transportation and Telecommunications 
Information 

Professional and Special Services 
Rentals 

Purchased Repairs and Maintenance 
Material and Supplies 

Machinery and Equipment 


Total 


$ 890,939 


P2995 


PAM 2) 


457,655 


170,707 


1,249 


3 25? 


17,500 


$ 1,605,422 
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ANNEX E: COMMISSIONER'"S OFFICE REVIEW PROGRAM — 


LOGIC MODEL 


Reports to Minister of 
National Defence, CSEC and 
National Security Advisor to | 


| the Prime Minister 
- assurance 
- information 
- findings 
- recommendations 
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ee 
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| procedures and 
practices 
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EC activities based 
on sound policies, 


sree 
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Plan, conduct and report on reviews 
and studies of CSEC’s activities 


Notifications to Minister 
of National Defence and 
Attorney General of any 
CSEC activity that may 
not be in compliance with 
the law 


Annual Reports to 

| Minister of National 
Defence for tabling 
in Parliament: 
- assurance 
- information 


eee 


: | 


| CSEC accepts and 


implements advice and 
recommendations 


Su 
of National Defence in 


his/her accountability 
for CSEC 
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Government and public confidence in the 
lawfulness of CSEC’s activities 
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ANNEX F: CLASSIFIED REPORTS TO THE MINISTER 


—" 
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Principal vs. agent status — March 3, 1997 (TOP SECRET) 

Operational policies with lawfulness implications — February 6, 1998 (SECRET) 
CSE’s activities under *** — March 5, 1998 (TOP SECRET Codeword/CEO) 
Internal investigations and complaints — March 10, 1998 (SECRET) 

CSE’s activities under *** — December 10, 1998 (TOP SECRET/CEO) 


On controlling communications security (COMSEC) material — May 6, 1999 
(TOP SECRET) 


How we test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s efforts to 
safeguard the privacy of Canadians) — June 14, 1999 (TOP SECRET 
Codeword/CEO) 


A study of the *** collection program — November 19, 1999 (TOP SECRET 
Codeword/CEO) 


On *** — December 8, 1999 (TOP SECRET/COMINT) 


A study of CSE’s *** reporting process — an overview (Phase [) 
— December 8, 1999 (SECRET/CEO) 


A study of selection and *** — an overview — May 10, 2000 (TOP SECRET/CEO) 


CSE’s operational support activities under *** — follow-up — May 10, 2000 
(TOP SECRET/CEO) 


Internal investigations and complaints — follow-up — May 10, 2000 (SECRET) 


On findings of an external review of CSE’s ITS program — June 15, 2000 
(SECRET) 


CSE’s policy system review — September 13, 2000 (TOP SECRET/CEO) 


A study of the *** reporting process — *** (Phase II) — April 6, 2001 
(SECRET/CEO) 


A study of the *** reporting process — *** (Phase III) — April 6, 2001 
(SECRET/CEO) 
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CSE’s participation *** — August 20, 2001 (TOP SECRET/CEO) 


CSE’s support to ***, as authorized by *** and code-named *** — August 20, 2001 
(TOP SECRET/CEO) 


A study of the formal agreements in place between CSE and various external 
parties in respect of CSE’s Information Technology Security (ITS) 
— August 21, 2002 (SECRET) 


CSE’s support to ***, as authorized by *** and code-named *** 
— November 13, 2002 (TOP SECRET/CEO) 


CSE’s *** activities carried out under the *** 2002 *** Ministerial authorization 
— November 27, 2002 (TOP SECRET/CEO) 


Lexicon of CSE definitions — March 26, 2003 (TOP SECRET) 


CSE’s activities pursuant to *** Ministerial authorizations including *** 
— May 20, 2003 (SECRET) 


CSE’s support to ***, as authorized by *** and code-named *** — Part I 
— November 6, 2003 (TOP SECRET/COMINT/CEO) 


CSE’s support to ***, as authorized by *** and code-named *** — Part II 
— March 15, 2004 (TOP SECRET/COMINT/CEO) 


A review of CSE’s activities conducted under *** Ministerial authorization 
— March 19, 2004 (SECRET/CEO) 


Internal investigations and complaints — follow-up — March 25, 2004 
(TOP SECRET/CEO) 


A review of CSE’s activities conducted under 2002 *** Ministerial authorization 
— April 19, 2004 (SECRET/CEO) 


Review of CSE *** operations under Ministerial authorization — June 1, 2004 
(TOP SECRET/COMINT) 


CSE’s support to *** — January 7, 2005 (TOP SECRET/COMINT/CEO) 


External review of CSE’s *** activities conducted under Ministerial authorization — 
February 28, 2005 (TOP SECRET/COMINT/CEO) 


A study of the *** collection program — March 15, 2005 (TOP SECRET/ 
COMINT/CEO) 


Report on the activities of CSE’s *** — June 22, 2005 (TOP SECRET) 
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45. 


46. 
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Interim report on CSE’s *** operations conducted under Ministerial authorization 
— March 2, 2006 (TOP SECRET/COMINT) 


External review of CSE *** activities conducted under Ministerial authorization 
— March 29, 2006 (TOP SECRET/CEO) 


Review of CSE’s foreign intelligence collection in support of the RCMP (Phase II) 
— June 16, 2006 (TOP SECRET/COMINT/CEO) 


Review of information technology security activities at a government department 
under ministerial authorization — December 18, 2006 (TOP SECRET) 


Review of CSE signals intelligence collection activities conducted under ministerial 
authorizations (Phase I) — February 20, 2007 (TOP SECRET/COMINT/CEO) 


Role of the CSE's client relations officers and the Operational Policy Section in the 
release of personal information — March 31, 2007 (TOP SECRET/COMINT/CEO) 


Review of information technology security activities at a government department 
under ministerial authorization — July 20, 2007 (TOP SECRET) 


Review of CSEC’s counter-terrorism activities — October 16, 2007 (TOP SECRET/ 
COMINT/CEO) 


Review of CSEC’s activities carried out under a ministerial directive 
— January 9, 2008 (TOP SECRET/COMINT/CEO) 


Review of CSEC’s support to CSIS — January 16, 2008 (TOP SECRET/ 
COMINT/ CEO) 


Review of CSEC signals intelligence collection activities conducted under 
ministerial authorizations (Phase II) — March 28, 2008 (TOP SECRET/ 
COMINT/CEO) 


Review of CSEC’s acquisition and implementation of technologies as a means to 
protect the privacy of Canadians — June 11, 2008 (TOP SECRET/COMINT/CEO) 


Review of CSEC foreign intelligence collection activities conducted under 
ministerial authorizations (Activity 1) — June 11, 2008 (TOP SECRET? 
COMINT/CEO) 


Review of disclosure of information about Canadians to Government of Canada 
clients — November 19, 2008 (TOP SECRET/COMINT/CEO) 


Review of CSEC foreign intelligence collection activities conducted under ministerial 
authorizations (Activity 2) — January 13, 2009 (TOP SECRET/COMINT/CEO) 
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Review of CSEC foreign intelligence collection activities conducted under a 
ministerial directive and ministerial authorizations (Activity 3) — February 26, 2009 
(TOP SECRET/COMINT/CEO) 


Review of CSEC activities conducted under a ministerial directive and in support 
of its foreign intelligence collection mandate — March 12, 2009 (TOP SECRET/ 
COMINT Codeword/CEO) 


Follow-up to a recommendation in a 2007-2008 review of CSEC activities carried 
out under a ministerial directive — March 12, 2009 (TOP SECRET/COMINT/CEO) 


Study of CSEC information technology security activities not conducted under 
ministerial authorization — June 11, 2009 (TOP SECRET/COMINT/CEO) 


Review of CSEC foreign intelligence collection activities conducted under 
ministerial authorizations and in support of government efforts relating to 
Afghanistan — January 18, 2010 (TOP SECRET/COMINT/CEO) 


Regular review of CSEC disclosure of information about Canadians to Government 
of Canada clients — February 16, 2010 (TOP SECRET/COMINT/CEO) 


Review of CSEC information technology security activities conducted under 
ministerial authorization (Activity 1) — October 18, 2010 (TOP SECRET/ 
COMINT/CEO) 


Review of CSEC activities carried out under a ministerial directive and used by 
CSEC to identify new foreign entities believed to be of foreign intelligence interest 
— December 16, 2010 (TOP SECRET/COMINT/CEO) 


Review of CSEC information technology security activities conducted under 
ministerial authorization (Activity 2) — February 14, 2011 (SECRET) 


Annual review of CSEC disclosures of information about Canadians to 
Government of Canada clients — February 21, 2011 (CONFIDENTIAL) 


Combined annual review of CSEC foreign signals intelligence collection activities 
conducted under ministerial authorizations — February 25, 2011 (TOP SECRET/ 
COMINT/CEO) 


Review of the process by which CSEC determines that entities of foreign 
intelligence interest are foreign entities located outside of Canada, as required by 
the National Defence Act — March 15, 2011 (TOP SECRET/COMIN T/CEO) 


en ANNUAL REPORT 


ANNEX G: LEGISLATIVE SAFEGUARDS FOR PRIVATE 
COMMUNICATIONS AND MEASURES TO PROTECT 
INFORMATION ABOUT CANADIANS 


In the execution of its foreign intelligence and information technology security 
mandates, CSEC is expressly prohibited pursuant to paragraph 273.64(2)(a) of the 
National Defence Act from directing its activities at Canadian citizens, permanent 
residents or corporations, regardless of their location. CSEC is also prohibited from 
directing its activities at any person in Canada, regardless of their nationality. 


However, due to the manner in which communications are transmitted, CSEC may, 
while conducting its mandated foreign signals intelligence or information technology 
security activities, unintentionally intercept communications of Canadians or persons 
in Canada, which constitute “private communications” under section 183 of the 
Criminal Code. 


Recognizing this possibility, the National Defence Act allows the Minister of National 
Defence to authorize CSEC to intercept private communications. Prior to granting this 
authorization, however, the Minister must be satisfied that certain conditions set out in 
the National Defence Act are met. There are four conditions for foreign signals 
intelligence ministerial authorizations (subsection 273.65(2)) and five conditions for 
information technology security ministerial authorizations (subsection 273.65(4)). 


CSEC’s foreign signals intelligence and information technology security reports 
may contain information about Canadians (as defined in section 273.61 of the 
National Defence Act) if such information is deemed essential to the understanding 
of the reports. However, this information must be suppressed, that is replaced by a 
generic reference such as “a named Canadian” person or company. When receiving a 
subsequent request for disclosure of the details of the suppressed information, CSEC 
must verify that the requesting government department or agency has both the 
authority and operational justification for obtaining such information. Only then may 
CSEC provide this information. 


ZL OPS ES LY |) ON RE iiripmemererritiiimiiin A7 
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The provision of assistance to federal law enforcement and security agencies under 
paragraph 273.64(1)(c) of the National Defence Act is not subject to the statutory 
prohibition contained in paragraph 273.64(2)(a) of the National Defence Act against 
directing activities at Canadians located anywhere or at persons located in Canada, 
provided that the assisted agency has the lawful authority. CSEC is also subject 
pursuant to subsection 273.64(3) of the National Defence Act to any limitations 
imposed by law on the assisted agency in the performance of its duties. 
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BIOGRAPHY OF THE HONOURABLE 
ROBERT DECARY, @.C. 


The Honourable Robert Décary, Q.C., was appointed Commissioner of 
the Communications Security Establishment on June 18, 2010. 


Commissioner Décary was born in Montréal in 1944. He received his 
education at Collège Jean-de-Brébeuf (BA), at Université de Montréal 
(LL.L.) and the University of London (LL.M.). He was called to the 
Québec Bar in 1967 and named Queen’s Counsel in 1986. 


In the course of a career dedicated to public office, the law and | 
journalism, he was Special Assistant to the Honourable Mitchell Sharp 
(then Canada’s Secretary of State for External Affairs) (1970-1973), 
Co-Director for Research on the Task Force on Canadian Unity, the 
Pepin-Robarts Commission (1978-1979) and member of the French 
Constitutional Drafting Committee of the Federal Department of Justice 
(1985-1990). 


He practised law in Montréal, then in Gatineau, where, in the firm — 
Noël, Décary, he specialized in representing many law offices and the 
Attorney General of Québec before the Supreme Court of Canada. 


He has written a number of feature articles for Le Devoir and 

La Presse, and has contributed to many legal journals and textbooks. 
He is the author of Aide-mémoire sur la Cour supréme du Canada 
(1988) and of Chére Elize (or The Long and the Short History of the 
Repatriation) (1983). 


He was a member of the Federal Court of Appeal from 1990 to 2009. In 
2009, he was appointed arbitrator of the Court of Arbitration for Sport 
in Lausanne, and in 2010 he became a member of the Sport Dispute 
Resolution Centre of Canada. 
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COMMISSIONER'"S MESSAGE 


The primary purpose of this report is to inform the Minister of National 
Defence of my activities during the fiscal year ending March 31, 2012. 
I will make mention of the results of reviews I conducted into the 
operations of the Communications Security Establishment Canada 
(CSEC) during the past year, as well as review projects currently under 
way and those that I expect to undertake in the next few months. I will 
also refer to other activities that I and my office have conducted, 
especially those meant to keep us abreast of the latest developments 

in Canada and abroad in the area of review of security and 

intelligence agencies. 


Two-thirds of the way through my three-year mandate, I am obliged to 
note that the public, and sometimes even so-called experts, continue, 
because of a lack of knowledge, to misjudge the respective roles of 
Canada’s various intelligence agencies and, consequently, those of the 
various review bodies. There is a reason for this ignorance. The secret 
nature of the activities of intelligence organizations is such that any 
attempts at educating the public come up against a culture of silence 
that makes one keep quiet even about what is known or what could be 
made known. To paraphrase a well-worn expression, the fear that one 
might see certain trees is such that one is not allowed to describe the 
forest. In my opinion, it is possible, without going into details it 
would be inappropriate to divulge, to employ simpler and more 
comprehensible language and thus ensure that public debates are not 
held on false premises. 


In my message of last year, I briefly described my own mandate and 
that of CSEC. This year, I shall be revisiting this in greater detail in 
my report. 


Technology is developing at a staggering pace. CSEC’s expertise in 
communications technology results in its providing assistance, pursuant 
to its mandate, to other members of Canada’s security and intelligence 
community, particularly the Canadian Security Intelligence Service 
(CSIS). This year, as I pursue my efforts to inform the public through 
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this report, I would like to better define the respective roles of CSEC and 
CSIS. I find that these roles are frequently misunderstood. 


When acting on its own initiative, CSEC does not have the right, under 
its enabling legislation, to target anyone within Canada or any Canadian 
outside Canada. However, CSEC also has a mandate to lend assistance 
to such organizations as CSIS, which might, upon request, lead to an 
involvement with a Canadian or someone on Canadian soil. In providing 
such assistance, CSEC is subject to the laws governing the organization 
that has made the request. 


Since CSIS, under its enabling legislation, is concerned with threats to 
the security of Canada and may conduct its investigations using methods 
including the interception of private communications, the invasion of the 
privacy of Canadians is inherent in these activities, and Parliament 
wanted these activities to take place only upon the securing of a judicial 
warrant. Accordingly, when CSIS is executing such a warrant and 
requests the assistance of CSEC, CSEC is in effect simply taking part in 
an activity already authorized by a court. It would be superfluous to 
require another warrant at that point. My predecessors have reviewed the 
assistance provided to CSIS by CSEC. This year, I undertook an in- 
depth review, which I will complete in the next few months, of certain 
activities in which CSEC acts on a request of CSIS. 


Furthermore, since CSEC is only authorized to target non-Canadians 
outside Canada, any interception of private communications involving 
Canadians is as unintentional as it is unforeseeable. Therefore, 
Parliament has required that these activities of CSEC that could 
unintentionally breach the privacy of Canadians be the object, not of a 
warrant, but of a ministerial authorization issued by the Minister of 
National Defence. This ministerial authorization, however, does not 
amount to a blank cheque; it comes with significant requirements, 
some legal and others that the Minister may prescribe, to ensure that, 
should the privacy of a Canadian become involved, measures are in 
place to protect it. 


ANNUAL REPORT 


AO aT RIC AM GRA AO A DA on A ts ee MUL à QU RRQ OUR vi A CRU RE A LE 


Increased cooperation between CSEC and CSIS in turn requires 
increased cooperation between the organizations that review them. This 
is not easily done, as the laws governing review bodies set up highly 
compartmented competencies that do not encourage pooling energies and 
resources. Lately, I have been working on finding ways of making the 
reviews that my office and the Security Intelligence Review Committee 
(SIRC) each undertake more complementary, to satisfy myself that no 
activities of CSEC and CSIS elude review. Paragraph 273.63(6) of the 
National Defence Act allows the Governor in Council to authorize me to 
engage in any related activity. Article 54 of the Canadian Security 
Intelligence Service Act allows the Minister of Public Safety and 
Emergency Preparedness to request from SIRC a “special report 
concerning any matter that relates to the performance of its duties and 
functions”. I am of the opinion that my office and SIRC could, by virtue 
of these provisions, be asked to conduct a joint review or complementary 
reviews of certain activities involving both CSEC and CSIS. This 
approach would be squarely in keeping with the recommendations 
formulated by Justice Dennis O’Connor, in his second report of the 
Commission of Inquiry into the Actions of Canadian Officials in Relation 
to Maher Arar, on the system for reviewing security and intelligence 
organizations in Canada. 


This annual report would not be complete if I did not highlight certain 
major changes in the top management of CSEC and in its status. 


Last January, John Adams, who had been Chief of CSEC for six years, 
was appointed as Senior Advisor to the Privy Council Office and as 
Skelton-Clark Fellow to the Queen’s University School of Policy 
Studies. I am in a position to testify just how much he was able to 
develop a culture of respect for privacy within CSEC. There will, of 
course, always be an inevitable and necessary climate of tension between 
a review body and the organization being reviewed. The challenge, then, 
for the heads of the two organizations is to make sure this tension is 
business-like and productive. To my mind, this has been the case. 
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John Forster, a seasoned senior civil servant, assumed leadership of the 
CSEC on January 30, 2012. I have met with him on several occasions 
and I already discern in him the traits of his predecessor. I am confident 
that our relationship will be marked by courtesy and respect. My team 
and I organized an intensive information session for the new Chief in 
order to present him with the clearest possible picture of how I carry out 
my review mandate under the Act. 


Incidentally, until November 16, 2011, CSEC had been under 
guardianship of a sort, reporting both to the Deputy Minister of National 
Defence for its administration and finances and to the National Security 
Advisor to the Prime Minister for its operations and policies. On that 
day, CSEC became an autonomous body in the National Defence 
Muinister’s portfolio with departmental status. Its Chief acquired the rank 
of Deputy Head and reports directly to the Minister. 


I do not expect this change of status to have any impact on the 
relationship between my office and CSEC. However, I am of the view 
that the requirement to report to the National Security Advisor to the 
Prime Minister allowed a broader government perspective on national 
security to be applied to CSEC operations and policies, and I will be 
watchful whether CSEC’s new autonomy results in any weakening of its 
accountability and compliance control framework. 
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MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT COMMISSIONER 


Overview 


+ My mandate (and CSEC’s) is set out in Part V.1 of the National Defence Act. 


* | operate at arms-length from government. 


- | submit detailed classified reports of my reviews of CSEC to the 
Minister of National Defence. 


+ My recommendations aim to reduce risks of non-compliance with the law by 
CSEC and to strengthen its practices to protect the privacy of Canadians. 


My mandate under the National Defence Act consists of three key 
functions: 


1. reviewing CSEC activities to ensure they comply with the law; 


2. conducting investigations | deem necessary in response to 
complaints about CSEC; and 


3. informing the Minister of National Defence and the 
Attorney General of Canada of any CSEC activities that I 
believe may not be in compliance with the law. 


Under the Security of Information Act, 1 also have a mandate to receive 
information from persons who are permanently bound to secrecy if they 
believe it is in the public interest to release special operational information 
of CSEC. To date, no such matters have been reported to a Commissioner. 
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Reviewing CSEC activities 
The purpose of my review mandate ts: 


¢ to ensure that activities conducted by CSEC under ministerial 
authorization are, in fact, those authorized by the Minister of 
National Defence; | 


¢ to ensure that CSEC complies with the law and, if I believe that it 
may not be complying, to report this to the Minister of National 
Defence and to the Attorney General of Canada; 


¢ to ensure that CSEC does not direct its foreign signals intelligence 
and information technology (IT) security activities at Canadians; 
and 


¢ to ensure that CSEC develops and effectively applies satisfactory 
measures to protect the privacy of Canadians in all the activities it 
undertakes. 


Conducting investigations 

My mandate includes undertaking any investigation I deem necessary in 
response to a written complaint — for example to determine whether 
CSEC has engaged, or is engaging, in unlawful activity or is not taking 
sufficient measures to protect the privacy of Canadians. 


Once a written complaint is received, if I determine that it has merit and 
relates to my mandate, I have all the powers of a Commissioner under 
Part II of the Inquiries Act to access and review any information held by 
CSEC. I may also interview — under oath, if necessary — any CSEC 
employee to establish the facts concerning a complaint. I advise the 
complainant, the Minister of National Defence and the Chief of CSEC 
about the results of a formal complaint investigation. If I believe that 
CSEC may not have complied with the law, I would report this to the 
Minister and to the Attorney General of Canada. 
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Informing the Minister 
Under my mandate, I also: 


<_ report the results of my reviews, in classified reports, to the 
Minister of National Defence, who is accountable to Parliament 
for CSEC; and 


* am required to submit an unclassified report to the Minister of 
National Defence on my activities each year, which the Minister 
must then table in Parliament. This is the 16" annual report. 


My reviews focus on CSEC’s compliance with its legal, ministerial and 
policy requirements. While it is my primary duty to report any non- 
compliance by CSEC, a necessary element of my mandate also includes 
informing CSEC of any activities that I believe might present, or have 
the potential to present, a risk of non-compliance, such as an unlawful 
interception of a private communication or other invasion of the privacy 
of a Canadian. If I am not satisfied that CSEC is responding to my 
concerns appropriately, I have the authority and the duty to report them 
to the Minister of National Defence. A number of my reports have 
included recommendations aimed at prevention. It is my goal to 
strengthen CSEC practices that contribute to compliance and incorporate 
measures that protect the privacy of Canadians. I believe it is ultimately 
more useful to prevent unlawful activity than to identify it after the fact. 


Independence 

While I submit my reports to the Minister responsible for CSEC, my office 
is independent and separate from the Department of National Defence. My 
review mandate is supported by the powers I have under the Inquiries Act. 
These powers ensure my access to all CSEC information and employees 
and include the power of subpoena. The independence of my mandate is 
further supported by the way my office is funded — it has been allocated 
its own appropriation from Parliament rather than receiving funding from 
the Department of National Defence. 
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Annex A contains the text of the relevant sections of the National Defence Act 
and the Security of Information Act relating to my role and mandate as CSE 
Commissioner (p. 41). Annex B describes the history of the Office of the 
CSE Commissioner (p. 45). 


MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT CANADA 


When the Anti-terrorism Act came into effect on December 24, 2001, it 
added Part V.1 to the National Defence Act, and set out CSEC’s three- 
part mandate: 


Part (a) authorizes CSEC to acquire and use foreign signals 
intelligence in accordance with the Government of Canada’s 
intelligence priorities; 


Part (b) authorizes CSEC to help protect electronic information 
and information infrastructures of importance to the 
Government of Canada; and 


Part (c) authorizes CSEC to provide technical and operational 
assistance to federal law enforcement and security agencies, 
including helping them obtain and understand communications 


collected under those agencies’ own authorities. 


Protection of Canadians 


CSEC is prohibited by law from directing its foreign signals intelligence 
collection and IT security activities at Canadians — wherever they might be lg eS 
the world — or at any person in Canada. | 
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LIMITATIONS IMPOSED BY LAW ON CSEC 


Parts (a) and (b) of CSEC’s mandate 

CSEC’s activities related to the collection of foreign signals intelligence 
and to the protection of electronic information and information 
infrastructures of importance to the Government of Canada are subject to 
three legislative limitations aimed at protecting Canadians’ privacy: 


1. CSEC is prohibited from directing its foreign signals 
intelligence collection and IT security activities at Canadians, 
regardless of their location anywhere in the world, or at any 
person in Canada, regardless of their nationality; 


2. In conducting these activities, CSEC may unintentionally 
intercept a communication that originates or terminates in 
Canada in which the originator has a reasonable expectation of 
privacy, which is a “private communication” as defined by the 
Criminal Code. CSEC may use and retain a private 
communication obtained this way but only if it is essential to 
either international affairs, defence or security, or to identity, 
isolate or prevent harm to Government of Canada computer 
systems or networks; and 


3. To provide a formal framework for the unintentional 
interception of private communications while conducting 
foreign signals intelligence collection or IT security activities, 
the National Defence Act requires express authorization by the 
Minister of National Defence. These are known as ministerial 
authorizations. The Minister may authorize the activities once he 
or she is satisfied that specific conditions provided for in the Act 
have been met, which includes assurances of how such 
unintentional interceptions of private communications would be 
handled should they arise. 


OO rer LA 


Private Communication. ‘any rol communication, or ‘any oo 
telecommunication, that is made by an originator who i is in Canada oo -— 
intended by the originator to be received by a person who is in Canada 
and that is made under circumstances in which it is reasonable for the — 


originator to expect that it will not be intercepted by any person other than. … 
the person intended by the originator to receive it, and includes any radio- 
based telephone communication that is treated electronically or eee 
for the purpose of preventing intelligible reception by any person other 

than the person intended by the originator to receive it” (section 183 of fs 
Criminal Code). | 


Ministerial authorizations 

When CSEC is conducting activities to acquire foreign signals intelligence, 
it cannot know beforehand with whom a targeted foreign entity outside 
Canada may communicate. Similarly, when CSEC is conducting activities 
to help protect Government of Canada computer systems, it cannot know 
beforehand who may communicate with or through that computer system. 
Given the complexity and interconnectedness of the global information 
infrastructure, it is unavoidable that CSEC will intercept a number of 
private communications. It is for this reason that CSEC requires a 
ministerial authorization for these activities — to shield itself from the 
Criminal Code in cases where it may unintentionally intercept a 
communication coming to or originating from Canada and where a person 
has an expectation of privacy. CSEC’s ministerial authorizations relate to 
an “activity” or “class of activities” specified in the authorizations — that 
is, to a specific method of acquiring foreign signals intelligence or of 
protecting computer systems (the how); the authorizations do not relate to 
a specific individual or subject (the whom or the what). 
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Conditions for ministerial authorizations 
To issue a ministerial authorization for foreign signals intelligence 
collection, the Minister must first be satisfied that: 


¢ the interception will be directed at foreign entities located outside 
of Canada; 


¢ the information could not be reasonably obtained by other means; 
¢ the expected value of the interception would justify it; and 


¢ satisfactory measures are in place to protect the privacy of 
Canadians and private communications will only be used or 
retained when essential to international affairs, defence or security. 


To issue a ministerial authorization to protect the computer systems or 
networks of the Government of Canada, the Minister must be satisfied 
that: 


¢ the interception is necessary; 
¢ the information could not be reasonably obtained by other means; 


¢ the consent of persons whose private communications may be 
intercepted could not reasonably be obtained; 


¢ satisfactory measures are in place to ensure that only information 
essential to identify, isolate or prevent harm to Government of 
Canada computer systems or networks will be used or retained; and 


¢ satisfactory measures are in place to protect the privacy of 
Canadians in the use and retention of that information. 


Ministerial authorization: authorization provided in writing by the Minister 

of National Defence to CSEC so that CSEC is not in contravention of the 
Criminal Code if — in the conduct of foreign signals intelligence collection or IT 
security activities — it should unintentionally intercept a private communication. 


An authorization can be in effect for no longer than one year. In 2011-2012, 
there were six foreign signals intelligence collection and two IT security 
ministerial authorizations in effect. 


2011-2012 13 


Each year, I review all of CSEC’s ministerial authorizations — which 
may be in effect for a period of no longer than one year — to ensure 
that the activities are authorized and that the above conditions for 
authorization are met. I report to the Minister of National Defence on 
my review. 


Part (c) of CSEC’s mandate 

For CSEC to provide assistance to federal law enforcement and security 
agencies in fulfilling their mandated activities, the National Defence Act 
requires that those agencies first demonstrate that they have the legal 
authority — such as an authorization or a warrant — to conduct the 
activities. CSEC is then subject to the same laws and limitations that 
govern the agencies it is assisting rather than to the three legislative 
limitations listed above. In addition, ministerial authorizations do not 
apply to these activities. 


MINISTERIAL REQUIREMENTS AND POLICIES TO 
PROTECT THE PRIVACY OF CANADIANS 


CSEC’s foreign signals intelligence and IT security activities are subject 
to measures, in addition to the limitations in the National Defence Act, 
that protect the privacy of Canadians in the use and retention of 
intercepted information. 


Both CSEC’s foreign signals intelligence and IT security program areas 
have dedicated sections responsible for day-to-day compliance and 
oversight. These two sections are important components of CSEC’s 
management monitoring and accountability frameworks, and I examine 
their effectiveness as part of my reviews. 


Handling of intercepted private communications 

CSEC should use available means to reduce, to the extent possible, the 
unintentional interception of the private communications of Canadians. 
But what happens when CSEC’s foreign signals intelligence and IT 
security activities result in unintentionally intercepted private 
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communications? If such unintentional interception does occur, these 
communications and information must be destroyed unless: 


¢ they consist of foreign intelligence as defined in the 
National Defence Act and in accordance with the Government 
of Canada intelligence priorities; 


* are essential to protect the lives or safety of individuals of any 
nationality; 


¢ contain information on serious criminal activity relating to the 
security of Canada; or 


¢ are essential to identify, isolate or prevent harm to Government of 
Canada computer systems or networks. 


When ministerial authorizations expire, the Chief of CSEC must 
report to the Minister of National Defence information on the private 
communications unintentionally intercepted. These reports must state 
how many private communications were used or retained — on the 
basis, as required by law, that they are essential to international 
affairs, defence or security, or essential to identify, isolate or prevent 
harm to Government of Canada computer systems or networks. These 
reports must also include the number and value of any foreign 
intelligence reports produced from the intelligence derived from the 
private communications. 


I examine the Chief’s reports to the Minister, monitor the number of 
private communications unintentionally intercepted, and verify how 
CSEC treated and used these communications. I am able to review all of 
the private communications that CSEC uses and retains. 


Directives and policies 

Ministerial directives contain written direction to the Chief of CSEC 
on the Chief’s duties and CSEC’s activities. The June 2001 
Ministerial Directive on Communications Security Establishment 
Accountability Framework sets out the accountability regime for 
CSEC, including a requirement for CSEC to report annually to the 
Minister of National Defence on CSEC’s priorities and initiatives as 
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well as legal, policy and management issues of significance. The 
Chief’s reports are one way I keep abreast of CSEC’s activities. They 
also inform the development of my review work plan. 


One ministerial directive in particular, the June 2001 Ministerial — 
Directive on Privacy of Canadians, reinforces the requirements in the 
National Defence Act and ministerial authorizations. It requires CSEC 
to adopt measures to minimize the unintentional interception of private 
communications. It states that CSEC may retain and report information 
on or of Canadians, subject to specific criteria and appropriate measures 
in place for the handling, retention and destruction of this information. 
The treatment of this information must be consistent with the 

Canadian Charter of Rights and Freedoms and the Privacy Act. Other 
ministerial directives provide guidance on specific CSEC activities. 


CSEC’s operational policy, Protecting the Privacy of Canadians and 
Ensuring Legal Compliance in the Conduct of CSEC Activities, applies 
to anyone conducting activities under CSEC authority, including CSEC 
employees and military personnel. It contains detailed measures for 
legal compliance and to safeguard the privacy of Canadians in the use 
and retention of intercepted information. Many other policies and 
procedures contain detailed requirements and provide instructions on 
specific CSEC activities and on measures to protect privacy. I review 
CSEC’s activities to ensure compliance with ministerial directives and 
policies and procedures. 


Information about Canadians: any personal oi (as described int 


Privacy Acf) about a Canadian, including a Canadian corporation. 
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Canadian identity information 

CSEC’s reports may contain Canadian identity information, if that 
information is deemed essential to understand the reports. However, the 
reference to an identified Canadian must be suppressed and replaced by 
a generic reference such as “a named Canadian” person or company. 
When receiving a subsequent request for disclosure of the details of the 
suppressed information, CSEC must verify that the requesting 
government department or agency has both the authority and the 
operational justification for obtaining the Canadian identity information. 
Only then may CSEC provide this information. Annually, I select and 
review a sample of these disclosures to verify that CSEC complies with 
the law and maintains measures to protect the privacy of Canadians. 


International collaboration 

CSEC and its closest international partners — the United States’ 
National Security Agency, the United Kingdom’s Government 
Communications Headquarters, the Australian Defence Signals 
Directorate, and the New Zealand Government Communications 
Security Bureau — respect each other’s laws by pledging not to target 
one another’s citizens’ communications. CSEC is prohibited from 
requesting an international partner to undertake activities that CSEC 
itself is legally prohibited from conducting. My reviews examine 
CSEC’s cooperation with its allies to ensure compliance with the law. 


CSEC training 

CSEC’s training program helps to ensure staff awareness of 
requirements and policies relating to lawfulness and the protection of the 
privacy of Canadians. Every new CSEC employee attends a foundational 
learning course, the curriculum of which includes information on legal 
and policy requirements and mandatory measures to protect privacy. For 
certain operational activities, CSEC’s employees are required to 
participate in briefings on legal requirements prior to conducting the 
activities and at least yearly thereafter. During my reviews, | determine 
the extent to which this training is effective by questioning CSEC 
employees about their understanding of the requirements. Annex C 
contains text of relevant sections of the National Defence Act relating to 
the role and mandate of CSEC (p. 47). 
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COMMISSIONER"S OFFICE AND 
REVIEW PROCESS 


I am supported in my work by a staff of eight, together with a number of 
subject-matter experts, under contract, as required. In 2011-2012, my 
office’s expenditures were $1,942,429, which is within the budget 
provided by Parliament. An expansion to the physical space of my office 
is under way, which will allow me to hire additional employees. 


Annex D provides the 2011-2012 Statement of Expenditures for the 
Office of the Communications Security Establishment Commissioner 


(p. 49). 


Objective of review 

The objective of my review is to enable me to provide to the Minister of 
National Defence, and indeed to all Canadians, assurance that CSEC is 
complying with the law and protecting the privacy of Canadians. If I were 
to find an instance where I believe CSEC may not have complied with 
the law, it would be my duty to inform the Minister of National Defence 
and the Attorney General of Canada. 


Selection of activities for review 

I use a risk-based and preventative approach to my reviews. I have a 
three-year work plan, which is updated twice per year. I draw on many 
sources to develop my work plan. My employees and I receive regular 
briefings from CSEC on new activities and on changes to existing 
activities of CSEC. I also go over the Chief of CSEC’s annual report to 
the Minister of National Defence on CSEC’s priorities and initiatives as 
well as legal, policy and management issues of significance. I then use a 
set of criteria to help select and prioritize CSEC activities based on 
where risk is greatest for potential non-compliance with the law 
including for risks to the privacy of Canadians. 
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Risk 1s assessed by considering, among other factors: 


* the controls placed by CSEC on the activity to ensure compliance 
with legal, ministerial and policy requirements; 


* whether the activity has the potential to involve private 
communications or information about Canadians; 


* whether the activity is new, has changed significantly, or has had a 
lengthy period elapse since its last in-depth review; 


+ whether there have been significant changes to the authorities or 
technologies relating to the activity; 


+ whether Commissioners have made findings or recommendations 
relating to the activity that require follow-up; and 


* issues arising in the public domain. 


Review methodology and criteria 

In conducting a review, my office examines CSEC’s hard-copy and 
electronic information and records, as well as CSEC’s policies and 
procedures and legal advice received from Justice Canada. My staff 
request briefings and demonstrations of specific activities, interview 
managers and employees and observe CSEC operators and analysts first 
hand to verify how they conduct their work. My staff test information 
obtained against the contents of systems and databases. The work of 
CSEC’s internal auditors and evaluators may also inform reviews. 


Each review includes an assessment of CSEC’s activities against a 
standard set of criteria, described below, consisting of legal 
requirements, ministerial requirements, and policies and procedures. 
Each review may have additional criteria added, as appropriate. 


Legal requirements: | expect CSEC to conduct its activities in 
accordance with the National Defence Act, the Privacy Act, the 
Criminal Code, the Canadian Charter of Rights and Freedoms 
and any other relevant legislation, and in accordance with 


Justice Canada advice. 
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Ministerial requirements: I expect CSEC to conduct its 
activities in accordance with ministerial direction, following all 
requirements and limitations set out in a ministerial 
authorization or directive. 


Policies and procedures: I expect CSEC to have appropriate 
policies and procedures in place to guide its activities and to 
provide sufficient direction on legal and ministerial 
requirements including the protection of the privacy of 
Canadians. I expect employees to be knowledgeable about and 
comply with policies and procedures. I also expect CSEC to 
employ an effective management control framework for 
maintaining the integrity and lawful compliance of its activities. 
This includes appropriate accounting for decisions taken and for 
information relating to compliance and the protection of the 
privacy of Canadians. 


My review reports document CSEC’s activities and practices and contain 
findings relating to the above-noted criteria. These reports may also 
disclose the nature and significance of deviations from the criteria. In 
some cases, I make recommendations to the Minister that are aimed at 
correcting discrepancies between CSEC’s activities and the expectations 
established by the review criteria. I monitor how CSEC addresses 
recommendations and responds to negative findings. As well, I monitor 
areas for follow-up identified in past reviews. 


The process of review is cumulative. Since my office was established in 
1996, it has built up specific expertise in CSEC’s unique mandate and 
activities. With each review my office adds to its knowledge of CSEC’s 
activities and of how we can improve our own methodology. One such 
change implemented in recent years by my office was the introduction of 
horizontal reviews — that is, review of the processes by which CSEC 
selects foreign intelligence targets and uses, shares, reports, retains or 
disposes of intercepted information that are common to each of the 
activities or class of activities. This approach has provided for greater 
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depth of review. My office examines each of these common processes to 
determine whether CSEC complies with the law and the extent to which 
CSEC takes measures to protect the privacy of Canadians. 


The Logic Model in Annex E provides a flow chart of our 
comprehensive review program (p. 50). 


Horizontal reviews examine processes common to all CSEC foreign signals 
intelligence collection methods or IT security activities under ministerial 
authorization. For example, the processes by which CSEC: 


* identifies, selects and directs its activities at entities of foreign intelligence 
interest; — 


* uses, shares, reports, retains or disposes of intercepted information; and 


* fakes measures fo protect private communications intercepted 
unintentionally and Canadian identity information. 


Recommendations 
Since 1997, my predecessors and I have submitted to the Minister of 


National Defence 68 classified review reports. In total, the reports 
contained 133 recommendations. CSEC has accepted and implemented 
or is working to address 93 percent (124 out of 133) of these 
recommendations. Recommendations have contributed to CSEC 
suspending certain activities to re-examine how the activities are 
conducted and to restructure the processes and practices supporting the 
activities. This past year, CSEC completed work in response to one past 
recommendation and I am monitoring 15 recommendations that CSEC is 
working to address. I continue to await the Minister’s response to one 
privacy-related recommendation I made in 2010-2011. 


My website provides a complete list of the 68 classified review reports 
submitted to the Minister of National Defence (www.ocsec-bccst.gc.ca). 
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OVERVIEW OF 2011-2012 FINDINGS 


During the 2011-2012 reporting year, I submitted seven reports to the 
Minister of National Defence on my review of CSEC activities. 


These reviews were conducted under two areas of my mandate: 


¢ ensuring CSEC activities are in compliance with the law — as set 
out in paragraph 273.63(2)(a) of the National Defence Act; and 


¢ ensuring CSEC activities under a ministerial authorization are 
authorized — as set out in subsection 273.65(8) of the 
National Defence Act. 


The results | 

Each year I provide a statement on my findings about the lawfulness 

of CSEC’s activities in general. Overall, I am able to report that the 
activities of CSEC examined this year complied with the law. I made no 
recommendations this year. However, I made a number of suggestions 
to improve certain policies and practices the application of which I will 
be monitoring. 


In some ways, it was a frustrating year due to delays in being able to 
proceed with some reviews. CSEC did not provide the same level of 
support to my office for these reviews, resulting in excessive delays. It 
has committed to correcting this situation. Ministerial direction requires 
the Chief of CSEC to support the Commissioner’s reviews. 
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HIGHLIGHTS OF THE SEVEN REVIEWS SUBMITTED 
TO THE MINISTER IN 2011-2012 


1. CSEC’s retention and disposal of intercepted 
or copied communications 


Background 

The ever-increasing amount of electronic information being generated in 
our interconnected world has created challenges for CSEC in managing 
the retention (storage) and disposal (destruction) of the information it 
acquires. CSEC’s foreign signals intelligence and IT security programs 
recently made significant technological changes impacting on their 
respective retention and disposal practices for acquired communications. 


Paragraph 273.64(2)(b) of the National Defence Act requires CSEC to 
take measures to protect the privacy of Canadians. It includes the 
manner in which CSEC retains and disposes of communications that it 
intercepts in the conduct of its foreign signals intelligence collection 
and IT security activities. In this review, I paid particular attention to 
CSEC’s retention and disposal of unintentionally intercepted private 
communications and Canadian identity information. 


As a Government of Canada institution, CSEC also has a legal 
requirement to keep certain records. The Access to Information Act and 
the Privacy Act both recognize that citizens have the right, under 
specified conditions, to access government records. Federal institutions, 
such as CSEC, must also protect any personal information that they may 
collect or transmit. These legal requirements reinforce the obligation for 
CSEC to maintain a comprehensive and complete inventory and 
description of its information holdings. The unauthorized destruction of 
a record could result in an inability to document an activity, and 
consequently, an inability to demonstrate compliance. 


My predecessors and I have always monitored CSEC’s information 


management practices because the creation and retention of records is one 
of the main means by which CSEC can account for its activities and 
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provide assurance that its activities comply with legal, ministerial and 
policy requirements. My predecessors made a number of recommendations 
that resulted in significant developments in CSEC’s information 
management practices and related systems to strengthen compliance. 


Findings 

I found that both CSEC’s foreign signals intelligence collection and IT 
security programs have incorporated into the digital architectures of their 
respective programs a number of legal, ministerial and policy 
requirements relating to retention and disposal. I acquired detailed 
knowledge of and documented this policy-based and technology-assisted 
approach to CSEC information management practices. During this 
review, I found that CSEC built a number of automated compliance 
requirements into its systems to permit monitoring and auditing of its 
activities, as well as providing one level of proof of that compliance. 


CSEC’s policies and procedures for retention and disposal of acquired 
communications provide sufficient direction to CSEC employees 
respecting these activities and the protection of the privacy of Canadians. 
The retention and disposal periods set out in CSEC policies are 
reasonable. However, CSEC’s inconsistent use of certain terminology in 
foreign signals intelligence and IT security policies is confusing and 
should be clarified. I will monitor CSEC efforts to clarify these policies. 


I also found that CSEC had implemented recommendations made by my 
predecessors to establish records management authorities and retention 
and disposition schedules. 


Conclusion 

I concluded that CSEC conducted its retention and disposal activities 
during the period under review in accordance with legal and ministerial 
requirements and its policies and procedures. 
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2. CSEC’s operations centre and particular 
foreign signals intelligence collection 
activities conducted in 2010 


Background 

CSEC’s operations centre serves as the primary point through which 
CSEC interacts with Government of Canada clients, international 
partners and various internal CSEC sections during times of significantly 
elevated or unexpected activity. During such periods, the centre provides 
increased coordination. As part of its routine duties, the centre 
coordinates and produces a daily operational brief for the Chief of CSEC 
and provides other information to management, as required. 


Findings 

My review focused on an examination of the centre through an assessment 
of some of its activities conducted in 2010 under CSEC’s mandates for 
foreign signals intelligence collection and assistance to federal law 
enforcement and security agencies. My highest priority was to assess the 
potential for risk posed to privacy in the conduct of these activities. 


I also paid particular attention to CSEC’s processing of requests from 
Government of Canada clients for releases of Canadian identity 
information suppressed in foreign signals intelligence reports produced 
by the centre. CSEC conducted these activities appropriately. 


In novel or uncertain circumstances characteristic of an operations 
centre, I found that CSEC’s use of temporary policy instruments to 
streamline approval processes in particular situations was appropriate. 
More broadly, CSEC managers and employees were aware of all 
relevant policies and procedures. CSEC managers routinely monitored 
their teams’ activities to ensure compliance with both law and policy. 


However, CSEC’s operational instructions for some activities provided 
only limited direction specific to the nature of the operations centre. 
CSEC recognized this gap and is developing an operational instruction 
tailored to the centre’s activities. I will monitor the implementation of 


this solution. 
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Conclusion 

I concluded that CSEC conducted the examined activities in accordance 
with the law and ministerial requirements. A primary factor affecting my 
decision to review CSEC’s operations centre was the potential for error 
in situations of increased pressure and time constraints. I found that, 
despite these circumstances in which the centre operated, the activities 
examined did not present any greater risk to compliance or to the privacy 
of Canadians than activities conducted by other sections of CSEC during 
routine business. 


3. Update on an ongoing review of CSEC’s 
foreign signals intelligence sharing with 
international partners 


Background 

It is common knowledge that Canada is a net importer of intelligence. 
CSEC’s ability to fulfill its foreign signals intelligence collection and IT 
security mandates rests, in part, on building and maintaining productive 
relations with its foreign counterparts. CSEC’s long-standing relationships 
with its closest allies — the United States’ National Security Agency, the 
United Kingdom’s Government Communications Headquarters, the 
Australian Defence Signals Directorate, and the New Zealand Government 
Communications Security Bureau — continues to benefit CSEC, and, in 
turn, the Government of Canada. This cooperative alliance may be more 
valuable now than at any other time, in the context of increasingly 
complex technological challenges. 


The global nature of terrorism requires security and intelligence 
agencies to cooperate and share information with one another. The 
Government of Canada’s response to the Report of the Standing 
Committee on Public Safety and National Security Review of the 
Findings and Recommendations Arising From the lacobucci and 
O'Connor Inquiries, recognized that: 


the exchange of information with foreign partners raises unique 
challenges — policy, legal and operational — that are examined 
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on a case-by-case basis in the context of Canada’s national 
security environment. The cumulative result of successive 
commissions of inquiry, reports and lessons learned has been the 
refinement of policies and practices surrounding the exchange of 
information between foreign partners and Canada’s national 
security and intelligence and law enforcement communities. (p. 4) 


The need for information sharing is vital. However, information must be 
exchanged in compliance with the laws of Canada and must include 
sufficient measures to protect the privacy of Canadians. Although these 
cooperative arrangements include a commitment by the partners to 
respect the privacy of each others’ citizens, it is recognized each partner 
is an agency of a sovereign nation that may derogate from the 
agreements, if it is judged necessary for their respective national 
interests. 


Past Commissioners have also examined specific aspects of CSEC’s 
foreign signals intelligence collection cooperation and sharing with 
international partners. This year, as part of this focused review, I 
provided the Minister with an update on my ongoing review of these 
activities. 


Findings 

Thus far, I have found that CSEC does take measures to protect the 
privacy of Canadians in what it shares with its international partners. For 
example, CSEC suppresses Canadian identity information in what is 
shared with its international partners. In addition, open and ongoing 
communications among the partners helps to limit the potential to affect 
the privacy of a Canadian. 


However, my review has also identified some important questions that I 
will continue to examine in the coming year, including: how does CSEC 
assure itself that its international partners follow the long-standing 
agreements and practices that provide a foundation for CSEC’s foreign 
signals intelligence information sharing? 


I will complete my review in 2012-2013. 
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4. Annual combined review of CSEC foreign 
signals intelligence ministerial authorizations 


Background 

Subsection 273.65(8) of the National Defence Act requires me to review 
CSEC activities carried out under ministerial authorizations “to ensure 
they are authorized and report annually to the Minister [of National 
Defence] on the review”. An annual combined review of the foreign 
signals intelligence collection ministerial authorizations is one way that I 
fulfill this part of my mandate. This year, I examined the five foreign 
signals intelligence ministerial authorizations in effect in 2009-2010 
relating to five activities or class of activities. The purpose of this annual 
combined review of the five foreign signals intelligence collection 
ministerial authorizations is to: 


1. identify any significant changes to the ministerial 
authorization documents themselves or to CSEC’s activities 
described in the authorizations; 


2. assess the impact, if any, of these changes on the risk of 
non-compliance and on the risk to privacy, and, as a result, 
identify any subjects requiring follow-up review; and 


3. examine a sample of my choosing of any resulting private 
communications unintentionally intercepted by CSEC 
during the conduct of the activities under the ministerial 
authorizations. 


Findings 

Within this approach, I assessed whether CSEC’s foreign signals 
intelligence collection activities complied with the law and protected the 
privacy of Canadians. I found that the activities carried out by CSEC 
under these ministerial authorizations were authorized. I also reviewed a 
sample of private communications retained by CSEC but that were not 
used in CSEC reports. I found that CSEC retained only those private 
communications essential to international affairs, defence or security, as 
required by paragraph 273.65(2)(d) of the National Defence Act. 
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For each of the five foreign signals intelligence collection activities, I 
examined certain key information relating to interception and to the 
privacy of Canadians, to permit comparison of the activities and to 
identify any significant changes or trends over time. 


The 2009-2010 foreign signals intelligence collection ministerial 
authorizations did not contain any significant changes from the previous 
year and CSEC did not make any significant changes to the technologies 
used for these activities. CSEC did, however, clarify and enhance 
associated operational policies, including direction relating to the 
protection of the privacy of Canadians. 


In addition, the effective periods for the ministerial authorizations 
changed — starting and ending on different dates from previous years’ 
authorizations. This affected my ability this year to examine year-to-year 
changes in certain metrics relating to interception and to the privacy of 
Canadians. In addition, certain information on intercepted 
communications involving CSEC’s international partners was not readily 
available. I will examine this issue as part of my ongoing review of 
CSEC’s foreign signals intelligence information-sharing activities with 
these partners. 


I examined CSEC’s activities in response to a 2009 recommendation that 
CSEC establish formal management processes for when CSEC considers 
undertaking certain proposed foreign signals intelligence collection 
activities and for the recording of the resulting decision. I found that 
CSEC addressed this recommendation in an amendment to an 
operational policy. 


As of the end of the 2011—2012 reporting period, I am awaiting a 
response from the Minister of National Defence to a recommendation I 
made in last year’s report that CSEC be required, in a ministerial 
authorization, to report to the Minister certain information relating to 
privacy. This requirement would support the Minister in his 
accountability for CSEC, including for the measures CSEC takes to 
protect the privacy of Canadians. The Minister had initially supported 
CSEC’s rejection of this recommendation. However, | sent the Minister 


2011-2012 29 


30 


further information and I understand that CSEC is now reviewing this 
matter. I remain of the view that CSEC should implement this 
recommendation. 


CSEC implemented a compliance validation program for its foreign signals 
intelligence activities. Changes to associated operational policy are also 
under development to address a recommendation in my review last year 
on this subject, as well as in response to a related audit report by CSEC’s 
internal auditors. Next year, I will begin a detailed review of CSEC’s 
management control framework and how this program helps CSEC 
document and demonstrate compliance with legal and policy obligations. 


Conclusion 
Apart from the instance on maintaining a recommendation from 
2010-2011, my review contained no recommendations. 


5. Annual review of a sample of disclosures of 
Canadian identity information to Government 
of Canada clients for calendar year 2011 


Background 

My predecessor directed in 2010 that an annual review of a sample of 
disclosures of Canadian identity information to Government of Canada 
clients be conducted, to verify that CSEC continues to comply with the 
law and maintains measures to protect the privacy of Canadians. 


Canadian identity information may be included in CSEC’s foreign 
signals intelligence reports if it is required to understand or use foreign 
intelligence. However, any information that identifies a Canadian must 
be suppressed in the reports — that is, replaced by a generic reference 
such as “a named Canadian”. When receiving a subsequent request for 
disclosure of the details of the suppressed information, CSEC must 
verify that the requesting client has both the authority and operational 
justification for obtaining the Canadian identity information. Only then 
may CSEC provide that information. 
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Findings 

I examined a sample representing approximately 20 percent of the total 
number of requests approved during the period under review. The 
sample included disclosures made to all of the Government of Canada 
departments and agencies that had requested Canadian identity 
information during the period under review. My officials examined: the 
requests documenting the clients’ authority and justification for 
obtaining the Canadian identity information; associated CSEC foreign 
signals intelligence reports; and the actual disclosures of Canadian 
identity information. 


I found that CSEC’s disclosure of suppressed Canadian identity 
information to Government of Canada clients was conducted in 
compliance with the law. Operational policies and procedures are in 
place and provide sufficient direction to CSEC employees respecting the 
protection of the privacy of Canadians and CSEC employees were 
knowledgeable about, and acted in accordance with, the policies and 
procedures. 


I also examined CSEC’s progress since last year to address my 2010 
recommendations relating to tools that could support the tracking of 
disclosures of Canadian identity information and improve the 
consistency and accuracy of related reporting. CSEC provided my 
officials with a demonstration of the capabilities of a new system for 
disclosures that has been introduced and will address the 
recommendations. I will continue to monitor the implementation of this 
system, and will ensure that it sufficiently incorporates safeguards to 
protect the privacy of Canadians. 


Conclusion 

My review did not result in any recommendations. However, my 
officials observed and communicated to CSEC that the section 
responsible for processing disclosure requests did not show its usual 
meticulousness during the period under review. Nevertheless, my 
officials found during their examination clear evidence that the activities 
were lawful and conducted in accordance with policies and procedures. 
While the gaps in CSEC’s records did not lessen the protection of the 
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privacy of Canadians in respect of those disclosures, I alerted CSEC to 
these gaps for the purpose of eliminating them. 


6. and 7. Annual review of incidents identified 
by CSEC in 2010 and annual review of 
incidents identified by CSEC in 2011 that 
affected or had the potential to affect the 
privacy of Canadians and the measures 
taken by CSEC to address them 


Background 

In 2007, the Chief of CSEC wrote to the Commissioner to inform him 
that CSEC had created a central file describing CSEC operational 
incidents that did or could impact the privacy of Canadians. The Chief 
indicated that the file would be made available to the Commissioner for 
review as a proactive means to demonstrate CSEC’s commitment to 
protecting privacy, helping ensure transparency and enhancing public 
confidence in CSEC. 


According to CSEC, it records in this central file any incidents that put 
at risk the privacy of a Canadian in a manner that runs counter to or is 
not provided for in its operational policies. CSEC policy requires CSEC 
foreign signals intelligence and IT security employees to report and 
document privacy incidents in order to demonstrate compliance with 
CSEC policies and legal requirements, and to prevent further incidents. 
Incidents could include the inadvertent inclusion of Canadian identity 
information in a report, or mistakenly sharing certain reports with the 
wrong recipient. 


My reviews of CSEC activities include an examination of any privacy 
incidents relating to the subject under review. The objectives of such 
annual reviews are to: acquire knowledge of the incidents and of 
corrective actions; and inform development of my work plan, by 
determining if there are any systemic issues or issues about compliance 
with the law or the protection of the privacy of Canadians that should be 
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subject to follow-up review. The review of these privacy incidents 
identified by CSEC also assists me in evaluating CSEC’s management 
control framework. My employees are vigilant during other reviews 
about identifying this type of error, so we can confirm whether CSEC 
also identified and addressed them. 


2010 findings 

In early 2011, I conducted an initial review of all of the 2010 privacy 
incidents in CSEC’s central file, but did not complete the review in time 
to report last year. I examined all foreign signals intelligence and IT 
security privacy incidents and the subsequent actions taken by CSEC to 
correct the incidents, focusing on those incidents not examined in detail 
in my other reviews. 


I was satisfied that CSEC took appropriate corrective actions in a timely 
manner in response to the privacy incidents it recorded during 2010. My 
review did not reveal any systemic deficiencies or issues that required 
follow-up review. I also noted that CSEC revised guidance about how to 
respond to certain privacy incidents. 


2010 conclusion 

My review of the privacy incidents in 2010 did not result in any 
recommendations. However, my officials identified and communicated 
to CSEC suggestions to make CSEC’s central file complete and 
consistent, in particular concerning the assessment of potential 
consequences flowing from the privacy incidents, and verifying whether 
and when corrective actions had been taken. 


2011 findings 

In 2012, I examined all foreign signals intelligence and IT security 
privacy incidents recorded by CSEC in calendar year 2011, and the 
subsequent actions taken by CSEC to correct the incidents. 


I was particularly interested in the remedial actions CSEC plans to take 
to address three particular privacy incidents. One involved CSEC issuing 
guidance to address a policy gap relating to CSEC exchanges of 
information containing Canadian identity information. This gap was 
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identified during one of my ongoing reviews. For two other privacy 
incidents relating to certain IT security activities, | am also pleased to 
note that CSEC will issue guidance for handling certain information and 
associated reporting. I will monitor CSEC’s efforts to address these 
follow-on activities. 


2011 conclusion 

I am satisfied that CSEC took appropriate corrective actions in response 
to the privacy incidents it recorded in 2011. My review of the privacy 
incidents in 2011 did not reveal any systemic deficiencies or issues that 
require follow-up review. I did not make any recommendations. 


I was generally satisfied that CSEC addressed the suggestions I made 

about it’s central file in 2010 to make it complete and consistent. Most 
entries for 2011 contained sufficient information, including corrective 
and mitigation actions taken by CSEC or by its partner agencies. 


COMPLAINTS ABOUT CSEC’S ACTIVITIES 


In 2011-2012, I received no complaints about CSEC activities that 
warranted investigation. This is not surprising because CSEC directs its 
activities at foreign entities located outside Canada. 


For details on the complaints process, visit the CSE Commissioner’s 
website (www.ocsec-becst.gc.ca). 


DUTY UNDER THE SECURITY OF INFORMATION ACT 


I have a duty under the Security of Information Act to receive 
information from persons who are permanently bound to secrecy seeking 
to defend the release of special operational information — such as 
certain information relating to CSEC’s activities — on the grounds that 
it is in the public interest. 


No such matters were reported to me in 2011—2012. 
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ACTIVITIES OF THE COMMISSIONER"S OFFICE 


Review Agencies Forum 

The Review Agencies Forum comprises officials from my office, the 
Security and Intelligence Review Committee (SIRC), the Office of the 
Inspector General of the Canadian Security Intelligence Service, the 
Commission for Public Complaints Against the Royal Canadian 
Mounted Police, and the Office of the Privacy Commissioner. The 
Forum contributes to the development of the review community through 
the exchange of expertise, research, developments in legislation and case 
law, and best practices relating to review. This year, a senior manager 
from the Security and Intelligence Secretariat of the Privy Council 
Office met with the Forum to discuss the government’s national security 
priorities and developments as well as proposals to strengthen review 
agencies and address the findings of recent inquiries. 


My office also delivered a second review workshop to provide 
formalized training to staff from Forum organizations that are relatively 
new to the function of review. 


Code of Values, Ethics and Conduct 

I approved a Code of Values, Ethics and Conduct that applies to all 
individuals employed by my office. The Code contains specific 
responsibilities and expected behaviours of employees relating to the 
conduct of their work and reviews of CSEC. This Code fulfills the 
requirement of section 5 of the Public Servants Disclosure Protection Act. 
I am confident that commitment to these values and observance of 

the Code’s behaviours will strengthen the ethical culture of the 
Commissioner’s office and contribute to its integrity. 


Other activities 

In September, my office’s Executive Director met with a Brazilian 
Federal Prosecutor who was a visiting academic at the Canadian Centre 
for Intelligence and Security Studies of Carleton University. This 
meeting informed the prosecutor’s work on accountability and review 
mechanisms for Brazilian intelligence activities. 
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In October, my office’s Executive Director, Director of Operations and 
legal counsel joined me at the Canadian Institute for the Administration 
of Justice’s conference, Zerrorism, Law and Democracy: 10 years after 
9/11. Leading experts on national security law, privacy and related topics 
explored how changes to Canadian law to combat terrorism have 
affected fundamental rights and values of procedural justice in the last 
decade. Together with the former Independent Reviewer of Terrorism 
Legislation in the United Kingdom and the former Chair of SIRC, I 
participated in a panel on procedure and accountability in anti-terrorism 
matters. We discussed the role and importance of independent review of 
security and intelligence agencies in the Canadian and international 
contexts. 


Also in October, officials from my office participated in a conference on 
the integration of privacy rights into security technologies, Vers une 
intégration du droit a la vie privée et des technologies de sécurité. The 
conference was organized by the Centre de recherche en droit public of 
the University of Montréal. My Executive Director participated in a 
panel and provided his perspectives on distinctions between national 
security and public safety and the integration of technology and privacy 
protection in national security. This conference also afforded my 
employees an opportunity to meet with Canadian and international civil 
servants, academics and students interested in issues of privacy, national 
security and public safety. 


In November, my employees and I attended the annual international 
conference of the Canadian Association for Security and Intelligence 
Studies (CASIS) in Ottawa. For the past 10 years, my office has 
supported CASIS conferences and seminars offered to members and 
students interested in broadening understanding of the issues affecting 
security and intelligence. Under this year’s theme, New Frontiers in 
Security and Intelligence, the conference explored new developments in 
this field. 
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The activities of CSIS are subject to review by SIRC. Those of CSEC 
are subject to review by me. SIRC and my own office are two separate, 
distinct and autonomous entities. SIRC may not investigate CSEC 
activities. My office may not investigate CSIS activities. It follows that 
when CSEC is acting at the request of CSIS, my powers of review begin 
only at the moment the request is made and are confined to the activities 
of CSEC — from the time the request is made, to the delivery of any 
information to CSIS. This year, I initiated discussions with the Chair and 
members of SIRC, and my Executive Director forwarded to SIRC a 
discussion paper on proposals for varying levels of cooperation in the 
conduct of reviews of activities involving both CSEC and CSIS. As I 
noted in my introduction, there is opportunity, under existing authorities, 
for greater collaboration between SIRC and my office, to enhance the 
effectiveness of review, in the spirit of the recommendations of the 
commission of inquiry led by the Honourable Justice Dennis O’Connor. 
In the coming year, I will pursue discussion of proposals to enhance 
collaboration of reviews of joint CSEC-CSIS activities. 


CSEC is a highly technical organization, and my office is expected to 
keep pace with the rapid technological changes affecting CSEC’s 
activities. For this reason, CSEC includes my employees in CSEC 
training, including introductory courses CSEC provides to new 
employees and training for the use of specific systems and databases. 


WORK PLAN — REVIEWS UNDER WAY AND 
PLANNED 


The results of several reviews currently underway are expected to be 
reported to the Minister of National Defence in the coming year and will 
be included in my 2012-2013 annual report. 


The subjects of these reviews include: CSEC’s foreign signals intelligence 
sharing with international partners; assistance to CSIS under CSEC’s 
mandate to provide support to federal law enforcement and security 
agencies and sections 12 and 21 of the CS/S Act, and CSEC IT security 
activities conducted in support of Government of Canada departments’ 
authorities under the Criminal Code and the Financial Administration Act. 
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Other reviews planned for 2012-2013, which may carry over to the next 
year, include reviews of: CSEC’s Office of Counter-Terrorism and its 
activities and interactions with CSIS; particular signals intelligence 
collection activities conducted under ministerial authorizations; IT security 
activities conducted under ministerial authorizations; and CSEC’s 
management control framework and compliance monitoring activities. 


In addition, I will continue the annual reviews of foreign signals 
intelligence ministerial authorizations, CSEC disclosures of Canadian 
identity information to government clients, and privacy incidents 
identified by CSEC and the measures subsequently taken by CSEC to 
address them. 


THE UPCOMING YEAR 


The coming year promises to be eventful. 


In May 2012, Canada hosts the 8" International Intelligence Review 
Agencies Conference in Ottawa. This is the second time that Canada is 
hosting this biennial conference, created in 1997. This year, it will bring 
together representatives of review bodies from 10 countries. 


This Conference constitutes a unique opportunity for all of us to each 
share our experiences with the others and to gain from drawing 
comparisons. When it comes to review, there is no standard structure. 
Some countries stress the role of Parliamentarians, others that of 
independent review bodies headed by appointed officials. Canada will 
use this opportunity to report on changes since we last hosted the 
Conference in 1999. This retrospective over the past thirteen years 
should give us the necessary perspective to better assess today’s reality 
and better predict tomorrow’s. 


This opportunity for perspective comes at the right time. The studies 
undertaken in Canada in recent years, particularly in the wake of the 
recommendations of Commissioners O’Connor, Iacobucci and Major on 
the possible reorganization of the intelligence and security review 
community, should bear fruit before long. Will some organizations be 
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shut down? — or merged? — or a new one created? — or a super- 
organization set up? Will there be a role for Parliamentarians and, if so, 
what kind? These are all questions that will give rise to a promising 
debate to which I look forward to contributing. 


I must raise once again the matter of clarifying certain provisions of the 
National Defence Act, something my predecessors and I have proposed 
repeatedly. I concede that this is a matter of opportunity and political 
context. But I confess to being deeply disappointed at the time that has 
passed without addressing the ambiguities in the Act which, to my mind, 
should raise no controversy. 


Finally, the title I have been given, Commissioner of the 
Communications Security Establishment, gives the impression that I am 
part of CSEC, whereas, on the contrary and for the reasons that led to 
my position being created in the first place, I am entirely independent. 

I have asked that this unfortunate designation be corrected. 
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ANNEX A: EXCERPTS FROM THE NATIONAL DEFENCE ACT 
AND THE SECURITY OF INFORMATION ACT RELATED TO THE 
MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT COMMISSIONER 


National Defence Act — Part V.1 
Appointment of Commissioner 


273.63 (1) The Governor in Council may appoint a supernumerary judge or a retired 
judge of a superior court as Commissioner of the Communications Security 
Establishment to hold office, during good behaviour, for a term of not more 
than five years. 


Duties 
(2) The duties of the Commissioner are: 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any 
activity of the Establishment that the Commissioner believes may not 
be in compliance with the law. 


Annual report 


(3) The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities and 
findings, and the Minister shall cause a copy of the report to be laid before 
each House of Parliament on any of the first 15 days on which that House is 
sitting after the Minister receives the report. 
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Powers of investigation 


(4) In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the Inquiries Act. 


Employment of legal counsel, advisors, etc. 


(5) The Commissioner may engage the services of such legal counsel, technical 
advisers and assistants as the Commissioner considers necessary for the 
proper performance of his or her duties and, with the approval of the 
Treasury Board, may fix and pay their remuneration and expenses. 


Directions 


(6) The Commissioner shall carry out such duties and functions as are assigned 
to the Commissioner by this Part or any other Act of Parliament, and may 
carry out or engage in such other related assignments or activities as may be 
authorized by the Governor in Council. 


Transitional 
(7) The Commissioner of the Communications Security Establishment holding 


office immediately before the coming into force of this section shall continue 
in office for the remainder of the term for which he or she was appointed. 


es. 
Review of authorizations 
273.65 (8) The Commissioner of the Communications Security Establishment shall review 


activities carried out under an authorization issued under this section to ensure 
that they are authorized and report annually to the Minister on the review. 
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Security of Information Act 


Public interest defence 


15. (1) No person is guilty of an offence under section 13 or 14 if the person establishes 
that he or she acted in the public interest. [...] 


Prior disclosure to authorities necessary 


(5) A judge or court may decide whether the public interest in the disclosure 
outweighs the public interest in non-disclosure only if the person has complied 
with the following: [...] 


(b) the person has, if he or she has not received a response from the deputy head 
or the Deputy Attorney General of Canada, as the case may be, within a 
reasonable time, brought his or her concern to, and provided all relevant 
information in the person’s possession to, [...] 


(ii) the Communications Security Establishment Commissioner, if the 
person’s concern relates to an alleged offence that has been, is being or 
is about to be committed by a member of the Communications Security 
Establishment, in the purported performance of that person’s duties and 
functions of service for, or on behalf of, the Communications Security 
Establishment, and he or she has not received a response from the 
Communications Security Establishment Commissioner within a 
reasonable time. 
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ANNEX B: HISTORY OF THE OFFICE OF THE 
COMMUNICATIONS SECURITY ESTABLISHMENT 
COMMISSIONER 


The Office of the Communications Security Establishment Commissioner was created 
on June 19, 1996, with the appointment of the inaugural Commissioner, the Honourable 
Claude Bisson, O.C., a former Chief Justice of Québec, who held the position until 

June 2003. He was succeeded by the late Right Honourable Antonio Lamer, P.C., C.C., 
C.D., LL.D., D.U., former Chief Justice of Canada, for a term of three years. The 
Honourable Charles D. Gonthier, C.C., Q.C., who retired as Justice of the Supreme Court 
of Canada in 2003, was appointed as Commissioner in August 2006, a position he held 
until his death in July 2009. The Honourable Peter deC. Cory, C.C., C.D., also a former 
Justice of the Supreme Court of Canada, served as Commissioner from December 14, 2009, 
to March 31, 2010. On June 18, 2010, the Honourable Robert Décary, Q.C., a former 
Justice of the Federal Court of Appeal, was appointed Commissioner. 


For the first six years (from June 1996 to December 2001), the Commissioner carried out 
his duties under the authority of Orders in Council issued pursuant to Part II of the 
Inquiries Act. During this period, the Commissioner’s responsibilities were twofold: to 
review the activities of the Communications Security Establishment Canada (CSEC) to 
determine whether they conformed with the laws of Canada; and to receive complaints 
about CSEC’s activities. 


The omnibus Anti-terrorism Act, which came into force on December 24, 2001, 
introduced amendments to the National Defence Act by adding Part V.1 and creating 
legislative frameworks for both the Commissioner’s office and CSEC. It gave the 
Commissioner new responsibilities to review activities carried out by CSEC under a 
ministerial authorization. The legislation also continued the Commissioner’s powers 
under the /nquiries Act. 


The omnibus legislation also introduced the Security of Information Act, which replaced 
the Official Secrets Act. This legislation gives the Commissioner specific duties in the event 
that a person, who would otherwise be permanently bound to secrecy, seeks to defend the 
release of classified information about CSEC on the grounds that it is in the public interest. 


While the Commissioner continues to provide the Minister of National Defence with his 


reports, the Commissioner’s office is separate from, and not part of, the Department of 
National Defence. 
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ANNEX C: EXCERPTS FROM THE NATIONAL DEFENCE ACT 
RELATED TO THE MANDATE OF THE COMMUNICATIONS 
SECURITY ESTABLISHMENT 


The Communications Security Establishment Canada (CSEC) is Canada’s national 
cryptologic agency, providing the Government of Canada with two key services: foreign 
signals intelligence, and information technology security. CSEC also provides technical 
and operational assistance to federal law enforcement and security agencies. 


CSEC’s foreign signals intelligence products and services support government decision- 
making in the fields of national security, national defence and foreign policy. CSEC’s 
signals intelligence activities relate exclusively to foreign intelligence and are directed by 
the Government of Canada’s intelligence priorities. 


CSEC’s information technology security products and services enable government 
departments and agencies to secure their electronic information systems and networks. 
CSEC also conducts research and development on behalf of the Government of Canada 
in fields related to communications security. 


CSEC’s three-part mandate is set out in subsection 273.64(1) of the National Defence Act: 
(a) to acquire and use information from the global information infrastructure for 
the purpose of providing foreign intelligence, in accordance with Government of 
Canada intelligence priorities; 

(b) to provide advice, guidance and services to help ensure the protection of 
electronic information and of information infrastructures of importance to 


the Government of Canada; and 


(c) to provide technical and operational assistance to federal law enforcement 
and security agencies in the performance of their lawful duties. 


CSEC’s website is: www.cse-cst.gc.ca. 
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ANNEX D: 2011-2012 STATEMENT OF EXPENDITURES 


Standard Object Summary ($) 
Salaries and Benefits 
Transportation and Telecommunications 
Information 
Professional and Special Services 
Rentals 


Repairs and Maintenance 


Material and Supplies 

Machinery and Equipment 

Assets 

Communications Equipment 29759 
Office Equipment and Furniture 50,031 
Informatics Equipment 38,700 
Leasehold Improvements in Progress 194,740 
Total 


1,022,064 


15,998 


11092 


386,906 


168,110 


232 


12,164 


12,070 


18280 


1,942,429 
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ANNEX E: COMMISSIONER"S OFFICE REVIEW PROGRAM — 
LOGIC MODEL 
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Reports to Minister of 
National Defence and 
CSEG 

- assurance 

- information 

- findings 

- recommendations 


CSEC activities based 


on sound policies, 
procedures and 
practices 


Plan, conduct and report on reviews 
and studies of CSEC’s activities 


Notifications to Minister 
of National Defence and 
Attorney General of any 
CSEC activity that may 
not be in compliance with 


Annual Reports to 
Minister of National 
Defence for tabling 
in Parliament: 

- assurance 

- information 


CSEC accepts and 
implements advice and 
recommendations 


Support for Minister 
of National Defence in 
his/her accountability 
for CSEC 


C suscept 
incidence of, lack of compliance 
with the law; high level of 
safeguarding privacy 


= : - D ~ ii 


Government and public confidence in the 
lawfulness of CSEC’s activities 
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Minister of National Defence 

MGen G.R. Pearkes Building, 13‘ Floor 
101 Colonel By Drive, North Tower 
Ottawa, Ontario 

K1A 0K2 


Dear Minister: 


Pursuant to subsection 273.63(3) of the National Defence Act, 1 am pleased 
to submit to you my annual report on my activities and findings for the period of 
April 1, 2012, to March 31, 2013, for your submission to Parliament. 


Yours sincerely, 


P.O. Box/C.P. 1984, Station “B”/Succursale «B» 
Ottawa, Canada 
K1P 5R5 
(613) 992-3044 Fax: (613) 992-4096 
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BIOGRAPHY OF THE HONOURABLE 
ROBERT DECARY, Q.C. 


The Honourable Robert Décary, Q.C., was appointed Commissioner of 
the Communications Security Establishment on June 18, 2010, for a 
three-year term. | 


Commissioner Décary was born in Montréal in 1944. He received his 
education at Collège Jean-de-Brébeuf (BA), at Université de Montréal 
(LL.L.) and the University of London (LL.M.). He was called to the 
Barreau du Québec in 1967 and named Queen’s Counsel in 1986. 


In the course of a career dedicated to public office, the law and 
journalism, he was Special Assistant to the Honourable Mitchell Sharp 
(then Canada’s Secretary of State for External Affairs) (1970-1973), 
Co-Director for Research on the Task Force on Canadian Unity, the 
Pepin-Robarts Commission (1978-1979) and member of the French 
Constitutional Drafting Committee of the federal Department of Justice 
(1985-1990). 


He practised law in Montréal, then in Gatineau, where, in the firm Noël, 
Décary, he specialized in representing many law offices and the 
Attorney General of Québec before the Supreme Court of Canada. 


He has written a number of feature articles for Le Devoir and 

La Presse, and has contributed to many legal journals and textbooks. 
He is the author of Aide-mémoire sur la Cour suprême du Canada 
(1988) and of Chère Élize (or The Long and the Short History of the 
Repatriation) (1983). 


He was a member of the Federal Court of Appeal from 1990 to 2009. In 
2009, he was appointed arbitrator of the Court of Arbitration for Sport 
in Lausanne, Switzerland, and in 2010 he became a member of the 
Sport Dispute Resolution Centre of Canada. 
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COMMISSIONER’S MESSAGE: A SUMMARY AT 
THE END OF MY TERM 


When the Minister of National Defence tables this annual report before 
Parliament, I will have completed my three-year term as 
Communications Security Establishment (CSE) Commissioner. For 
personal reasons I declined an offer to renew my mandate. This message 
affords me an opportunity to reflect on my time as the head of 

the Office of the CSE Commissioner. 


Reports and recommendations 

During my tenure as Commissioner I submitted to the Minister of 
National Defence 19 review reports, covering almost every aspect of the 
activities of Communications Security Establishment Canada (CSEC), 
including those carried out under ministerial authorizations or at the 
request of law enforcement and security agencies. Among the activities 
reviewed were those relating to the collection of foreign signals 
intelligence, the protection of electronic information and information 
infrastructures considered important by the Government of Canada, and 
technical and operational assistance provided by CSEC, notably to the 
Canadian Security Intelligence Service (CSIS). My reports contained 
12 recommendations. 


The integrity of the review process and the credibility of the 
Commissioner’s office depend in large part on the follow-up by the 
office of CSEC’s implementation of Commissioners’ recommendations. 
I am pleased to note that since 1997, fully 92 percent (127 of 138) of 
Commissioners’ recommendations in 74 classified reports submitted to 
the Minister have been accepted and implemented, or are being 
addressed. This means, inter alia that measures to protect the privacy of 
Canadians are continually being adapted and refined to reflect the ever- 
changing technological and operational environment in which CSEC 
must work. Indeed, some Commissioners’ recommendations have 
resulted in CSEC suspending certain activities to re-examine how the 
activities are conducted and, in other instances, have led to important 
improvements to CSEC policies and practices. 
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Maintaining healthy relations with CSEC 

It strikes me as vital that an organization under independent review and 
the review body itself cultivate a relationship built on respect and good 
faith. By law, CSEC must take measures to protect the privacy of 
persons in Canada and Canadians, wherever in the world they may be. 
By law, the Commissioner must ensure that CSEC meets this obligation. 
The protection of privacy is therefore a shared objective of our two 
organizations. I also consider it essential that our relationship be one of 
complementarity rather than superiority. With my years of experience, I 
see the office more as CSEC’s conscience than as a sword of Damocles, 
and I believe that CSEC increasingly sees it this way as well. 


I can say with confidence that CSEC’s Chiefs during my time as 
Commissioner, John Adams initially and then John Forster, have spared 
no effort to instill within CSEC a culture of respect for the law and for 
the privacy of Canadians. Both men have been honest in their dealings 
with me, sometimes tough, but always acting in good faith. 


Transparency 

From the start of my time as Commissioner, I have sought to demystify, 
within the unavoidable constraints of national security and public safety, 
the culture of secrecy pervading the activities of security and intelligence 
agencies. I believe I have succeeded to some degree, based on the 
feedback that my annual reports have been more informative, more 
understandable, and have brought clarity to many of the activities of my 
office and of CSEC. Much remains to be done, but I believe that the ice 
has been broken and that the security and intelligence agencies 
understand they can speak more openly about their work without 
betraying state secrets or compromising national security. The greater 
the transparency, the less sceptical and cynical the public will be. 
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It is in this context of transparency that the Commissioner’s office 
organizes periodic luncheon meetings with outside experts in the fields 
of national security and privacy. This facilitates greater understanding on 
their part of how we go about our work, and we in turn learn about their 
perspectives and interests. 


Review bodies working cooperatively 

My office and the Security Intelligence Review Committee (SIRC) have 
similar functions but are subject to different legislation. CSEC and CSIS 
also have different legislation but their respective laws authorize 
cooperation between them, whereas the legislation governing my office 
and SIRC does not contain similar provisions. This means that where 
CSEC and CSIS cooperate and conduct joint activities, my office and 
SIRC do not have an equivalent authority to conduct joint reviews. 
Nonetheless, I believe a certain amount of collaboration among review 
bodies is possible under existing legislation. For example, where I have 
no mandate to follow-up, I may refer questions to SIRC that concern 
CSIS. Activities beyond this, such as the sharing of special operational 
information of the agencies, may require the intervention and approval 
of Cabinet, and possibly also legislative change. Ideally, the law should 
authorize, even encourage, such cooperation. 


The creation of an over-arching structure that would group existing 
review bodies under a single umbrella, proposed in a past commission of 
inquiry report, does not strike me as a sensible solution at this point. 
Before we create an additional super-bureaucracy, with the associated 
burden and costs, we may be better advised to optimize existing review 
bodies and facilitate their collaboration. 
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Another form of cooperation among security and intelligence review 
bodies has occurred over the past few years. My office has provided an 
introductory training course for new employees of security and 
intelligence review bodies, to explain various review methods and to 
contribute to the development of more rigorous review practices. 


Information sharing with international partners 

The growth of international cooperation in the intelligence field has 
important implications for privacy. We want to ensure that the foreign 
countries and organizations with which Canada exchanges information 
protect privacy with as much rigour as Canada exercises. This is not an 
easy task. On the one hand, nations are sovereign and do not appreciate 
interference in their internal affairs, particularly not in the area of 
security. On the other hand, review bodies and mechanisms vary from 
country to country. In the absence of international intelligence review 
standards, I believe the best guarantee of the protection of the privacy of 
Canadians in information exchanged with international partners lies in 
promoting and ensuring strong and independent review bodies in those 
countries. We are, in fact, already doing this to some extent. 


For the past 15 years, the review bodies of a dozen countries, including 
members of the “Five-Eyes” countries (Canada, the United States, 

the United Kingdom, Australia and New Zealand), have attended a 
biennial conference. These meetings have been a source of rewarding 
exchanges and new inspiration. The sharing of perspectives and best 
practices is a stimulating and enriching experience. As well, countries 
for which independent intelligence review is in its early stages may be 
invited to attend the conferences as observers and gain knowledge 
about what is happening elsewhere. Canada hosted this conference in 
May 2012. 
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On the bilateral level, my office meets with representatives of foreign 
review bodies and oversight committees. This past year, for example, I 
met with members of a delegation of French parliamentarians seeking 
information on the nature and methodology of Canadian review bodies. I 
have also met with members of the Belgian Standing Intelligence 
Agencies Review Committee and the British Intelligence and Security 
Committee. It is my wish that these kinds of beneficial meetings occur 
more frequently. 


Cyber security and cyber attacks 

One can no longer talk about security without mentioning cyber threats. 
Barely a week goes by without headlines dealing with the risk of 
breaches of public and private computer systems. CSEC, by its very 
mandate, is called on to play a leadership role in protecting electronic 
information and information infrastructures of importance to the 
Government of Canada. CSEC may also lend its experience to assist 
Public Safety Canada in its role of helping to protect critical 
infrastructure that may involve the private sector. 


It is unavoidable that CSEC may unintentionally intercept the private 
communications of Canadians while conducting certain information 
technology (IT) security activities. For this reason, in recent years, the 
Commissioner’s office has increased its vigilance in this area, 
completing a number of reviews, while others have been initiated; I have 
no doubt that my successor will continue this work. 


Proposals for legislative changes to the National Defence Act 

I started my mandate with the expectation that the legislative 
amendments to the National Defence Act proposed by my predecessors 
would soon be introduced in Parliament, but this has yet to happen. I 
am deeply disappointed at the lack of action by the government, which 
is no longer in a minority situation, to address the ambiguities identified 
by my predecessors and myself. These amendments — as I have said 
many times before — would improve the provisions that were hastily 
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enacted in the aftermath of September 11, 2001. The proposals to 
address the issues raised by Commissioners should not, in my opinion, 
be controversial. 


The independence of the Office of the CSE Commissioner 

The office attained its institutional and financial independence just 
over five years ago when it received its own funding approved by 
Parliament, and was no longer part of the budget of the Department of 
National Defence. To emphasize this independence, 2011 marked the 
first time the Commissioner issued his own news release to highlight 
the tabling in Parliament of his annual report by the Minister of 
National Defence. Financial independence, however, does have its 
drawbacks. As a result of having its own appropriation, the 
Commissioner’s office, a micro-agency with a budget of roughly two 
million dollars, is subject to the same accounting and reporting 
requirements as all departments, each with their individual budgets, 
some into the billions. To my mind, this is an example of excessive 
bureaucracy that has resulted in a significant level of reporting that is 
of limited value to both the office and its stakeholders. 
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MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT COMMISSIONER 


My mandate under the National Defence Act consists of three key 
functions: 


1. reviewing CSEC activities to determine whether they 
comply with the law; 


2. conducting investigations I deem necessary in response 
to complaints about CSEC; and 


3. informing the Minister of National Defence (who is 
accountable to Parliament for CSEC) and the 
Attorney General of Canada of any CSEC activities that 
I believe may not be in compliance with the law. 


Under the Security of Information Act, | also have a mandate to receive 
information from persons who are permanently bound to secrecy if they 
believe it is in the public interest to release special operational information 
of CSEC. (More information on the Commissioner’s responsibilities for 
public interest defence is available on the office’s website.) 


CSEC’s mandate 


When the Anii-terrorism Act came into effect on December 24, 2001, it added 
Part V.1 to the National Defence Act, and set out CSEC’s three-part mandate: 


* part (a) authorizes CSEC to acquire and use foreign signals intelligence in 
accordance with the Government of Canada’s intelligence priorities; 


part (b) authorizes CSEC to help protect electronic information and 
information infrastructures of importance to the Government of Canada; and 


part (c) authorizes CSEC to provide technical and operational assistance 
to federal law enforcement and security agencies, including helping them 
obtain and understand communications collected under those agencies’ 
own lawful authorities. 
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Reviewing CSEC activities 

My mandate to review CSEC activities relates to CSEC collecting 
foreign signals intelligence, protecting electronic information and 
information infrastructures of importance to the Government of Canada, 
and assisting federal law enforcement and security agencies. 


The purpose of my review mandate is: 


+ to determine whether the activities conducted by CSEC under 
ministerial authorization are, in fact, those authorized by the 
Minister of National Defence, and to verify that the conditions for 
authorization required by the National Defence Act are met; 


+ to determine whether CSEC complies with the law and, if I 
believe that it may not be complying, to report this to the 
Minister of National Defence and to the Attorney General 
of Canada; 


+ to verify that CSEC does not direct its foreign signals intelligence 
and IT security activities at Canadians; and 


¢ to promote the development and effective application of 
satisfactory measures to protect the privacy of Canadians in all the 
activities CSEC undertakes. 


Protection of Canadians 


CSEC is prohibited by law from directing its foreign signals intelligence 


collection and IT security activities at Canadians — wherever they might be in 
the world — or at any person in Canada. 


Ministerial authorizations 

The National Defence Act allows the Minister of National Defence to 
give CSEC written ministerial authorization to unintentionally intercept 
private communications while collecting foreign signals intelligence or 
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while protecting computer systems of the Government of Canada from 
mischief, unauthorized use or interference. In each case, the law 
specifies the conditions under which a ministerial authorization can be 
issued. Ministerial authorizations relate to an activity or class of 
activities specified in the authorizations — that is, to a specific method 
of acquiring foreign signals intelligence or of protecting computer 
systems (the how); however the authorizations do not relate to a specific 
individual or subject (the whom or the what). The law also directs the 
CSE Commissioner to review activities carried out under a ministerial 
authorization and to report annually to the Minister on the review. (More 
information on ministerial authorizations as well as on the authorities for 
and limitations on CSEC activities are available on the office’s website.) 


selection of activities for review 

I use a risk-based and preventative approach to my reviews. I prioritize 
CSEC activities where risk is greatest for potential non-compliance with 
the law, including for risks to the privacy of Canadians, by considering, 
among other factors: 


¢ the controls placed by CSEC on the activity to ensure compliance 
with legal, ministerial and policy requirements; 


¢ whether the activity does, or has the potential to, involve private 
communications or information about Canadians; 


¢ whether the activity is new, has changed significantly, or has had a 
lengthy period elapse since its last in-depth review; 


¢ whether there have been significant changes to the authorities or 
technologies relating to the activity; 


¢ whether Commissioners have made findings or recommendations 
relating to the activity that require follow-up; and 


* issues arising in the public domain. 
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Information about Canadians: any personal information (as described in fhe 


Privacy Acf) about a Canadian, or business information about a Canadian 
corporation. 


Review methodology and criteria 

My reviews of activities are ex post, that is, of activities that have 
occurred in the past. However, reviews always include an examination 
of CSEC’s ex ante reasons for conducting the activities — to confirm 
that CSEC’s justifications for the activities are lawful and within 
CSEC’s mandate. In conducting a review, my office examines CSEC’s 
hard-copy and electronic information and records, as well as CSEC’s 
policies and procedures and legal advice received from Justice Canada. 
My employees request briefings and demonstrations of specific 
activities, interview CSEC managers and employees, and observe CSEC 
operators and analysts first hand to verify how they conduct their work. 
My employees test information obtained against the contents of CSEC’s 
systems and databases. 


Each review includes an assessment of CSEC activities against a 
standard set of criteria, described below, consisting of legal 
requirements, ministerial requirements, and policies and procedures. 
Each review may have additional criteria added, as appropriate. 


Legal requirements: I expect CSEC to conduct its activities 
in accordance with the National Defence Act, 

the Canadian Charter of Rights and Freedoms, the Privacy Act, 
the Criminal Code, and any other relevant legislation, and in 
accordance with Justice Canada advice. 


Ministerial requirements: I expect CSEC to conduct its 
activities in accordance with ministerial direction, following all 
requirements and limitations set out in a ministerial 
authorization or directive. 
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Policies and procedures: I expect CSEC to have appropriate 
policies and procedures in place to guide its activities and to 
provide sufficient direction on legal and ministerial 
requirements including the protection of the privacy of 
Canadians. I expect CSEC employees to be knowledgeable 
about and comply with policies and procedures. I also expect 
CSEC to have an effective compliance validation framework 
and activities to ensure the integrity of operational activities is 
maintained, including appropriately accounting for important 
decisions and information relating to compliance and the 
protection of the privacy of Canadians. 


My classified review reports document CSEC activities and practices 
and contain findings relating to the above-noted criteria. These reports 
may also disclose the nature and significance of deviations from the 
criteria. In some cases, I make recommendations to the Minister that are 
aimed at correcting discrepancies between CSEC activities and the 
expectations established by the review criteria. 


The logic model in Annex A provides a flow chart of the review 
program (p. 41). 


Horizontal reviews 

Horizontal reviews examine processes common to all CSEC foreign 
signals intelligence collection methods or to IT security activities. 
For example, the processes by which CSEC: 


¢ identifies, selects and directs its activities at foreign entities of 
intelligence interest located outside Canada or at threats to 
Government of Canada computer systems; 


* uses, shares, reports, retains or disposes of intercepted 
information; or 


¢ takes measures to protect private communications intercepted 
unintentionally and to protect information about Canadians. 
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Conducting investigations 

My mandate includes undertaking any investigation I deem necessary in 
response to a written complaint — for example to determine whether 
CSEC has engaged, or is engaging, in unlawful activity or is not taking 
sufficient measures to protect the privacy of Canadians. (More 
information on the Commissioner’s responsibilities for conducting 
investigations into complaints is available on the office’s website.) 


Informing the Minister 
Under my mandate to keep the Minister of National Defence informed, I: 


¢ forward the results of my reviews, in classified reports, to the 
Minister; and 


¢ submit an unclassified report to the Minister on my activities each 
year, which the Minister must then table in Parliament. This is the 
17" annual report. 


While it is my primary duty to report any non-compliance by CSEC, a 
necessary element of my mandate also includes informing the Minister 
of any activities that I believe might present, or have the potential to 
present, a risk of non-compliance, such as an unlawful interception of a 
private communication or other invasion of the privacy of a Canadian. 
A number of my reports have included recommendations aimed at 
prevention. It is a goal of the Commissioner’s office to strengthen CSEC 
practices that contribute to compliance and incorporate measures that 
protect the privacy of Canadians. 


Independence 

While I submit my reports to the Minister of National Defence, who is 
responsible for CSEC, my office is completely independent and receives 
its own funding from Parliament. My mandate is supported by the 
powers I have under the /nquiries Act, including the power of subpoena, 
to ensure access to all CSEC information and employees. 
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CSE Commissioner 


The Commissioner is an independent statutory officer and is not subject to 
general direction from the Prime Minister, the Minister of National Defence or 
any other ministers on how to carry out his mandate. The Commissioner assists 


the Government of Canada in its control of CSEC by providing advice to the 
Minister to support the Minister's decision making and accountability for CSEC. 
The Commissioner's classified reports to the Minister and unclassified annual 
report, through the Minister to Parliament and the public, state whether CSEC 
has acted lawfully and the extent to which it protected the privacy of 
Canadians in the conduct of its activities. 


Annex B contains the text of the relevant sections of the 

National Defence Act and the Security of Information Act relating to 
my role and mandate as CSE Commissioner (p. 43). (Information on 
the history of the Office of the CSE Commissioner is available on the 
office’s website.) 


COMMISSIONER'S OFFICE 


Last year, work was completed on the expansion of the physical space of 
the office, to provide sufficient accommodation for existing functions, 
and for additional responsibilities resulting from the office receiving its 
own appropriation from Parliament. The expansion will allow me to hire 
two additional review officers to enable adequate review of CSEC, 
which has experienced significant growth. I have been supported in my 
work by a staff of eight, together with a number of subject-matter 
experts, as required. In 2012—2013, my office’s expenditures were 
$2,285,718, which is within the overall funding approved by Parliament. 


Annex C provides the 2012-2013 Statement of Expenditures for the 
Office of the CSE Commissioner (p. 47). 
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IMPACT OF COMMISSIONERS’ 
RECOMMENDATIONS 


Since 1997, my predecessors and I have submitted to 

the Minister of National Defence 74 classified review reports. In total, 
the reports contained 138 recommendations. CSEC has accepted and 
implemented or is working to address 92 percent (127 out of 138) of 
these recommendations. 


Commissioners monitor how CSEC addresses recommendations and 
responds to negative findings as well as areas for follow-up identified in 
past reviews. This past year, CSEC advised my office that work had 
been completed in response to 14 past recommendations. Notably, CSEC 
implemented recommendations by: 


* providing support to the Minister of National Defence to update 
certain ministerial directives; 


¢ updating general memoranda of understanding for the exchange 
of information and operational cooperation with CSIS and 
Foreign Affairs and International Trade Canada; 


° committing to report to the Minister of National Defence certain 
information (that cannot be publicly identified for security 
reasons), as a measure to protect the privacy of Canadians and to 
support the Minister in his accountability for CSEC; 


° promulgating a revised policy for operational assistance to law 
enforcement and security agencies under part (c) of CSEC’s 
mandate, including guidance on the retention and disposition of 
records relating to any assistance; 


* promulgating a revised procedure that defines risk and risk 
mitigation for certain foreign signals intelligence collection 
activities as well as adopting a risk management framework for 
the planning and approval of these activities; and 
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* launching a new secure system with other government 
departments and agencies for handling and tracking requests for 
and disclosures of suppressed Canadian identity information. 


These actions by CSEC demonstrate that review works. The 
Commissioner’s office will examine the impact of these enhancements 
on compliance and privacy protection in future reviews. In addition, the 
Commissioner’s office is monitoring six active recommendations that 
CSEC is working to address. The Minister’s responses to two 
recommendations of this year were not received by the time this report 
was completed. 


The office’s website provides a complete list of the 74 classified review 
reports submitted to the Minister of National Defence. 


OVERVIEW OF 2012-2013 FINDINGS AND 
RECOMMENDATIONS 


During the 2012—2013 reporting year, I submitted six reports to the 
Minister of National Defence on my review of CSEC activities. 


These reviews were conducted under two areas of my mandate: 


* ensuring CSEC activities are in compliance with the law — as set 
out in paragraph 273.63(2)(a) of the National Defence Act; and 


* ensuring CSEC activities under a ministerial authorization are 
authorized — as set out in subsection 273.65(8) of the 
National Defence Act. 
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The results 

Each year, I provide an overall statement on my findings about the 
lawfulness of CSEC activities. With the exception of one review 
described below — in which I was unable to reach a definitive 
conclusion about compliance or non-compliance with the law for certain 
CSEC foreign signals intelligence activities — all of the activities of 
CSEC reviewed this past year complied with the law. 


As well, this year, I made four recommendations to promote 
compliance with the law and to strengthen privacy protection. The 
recommendations, which are described in the following review 
summaries, relate to reinforcing policy guidance and expanding an 
existing practice on privacy protection to other circumstances, as well 
as providing the Federal Court of Canada with certain additional 
evidence about the nature and extent of the assistance CSEC may 
provide to CSIS. 


Additionally, I forwarded to the Chair of SIRC, for information, 
certain general points relating to CSIS that arose out of the 
recommendations I made and that SIRC may wish to examine as it 
deems appropriate. This demonstrates how existing review bodies 
can, in the spirit of the recommendations of the commission of 
inquiry led by the Honourable Justice Dennis O’ Connor, collaborate 
under existing legislation in the conduct of reviews of activities 
involving more than one security and intelligence agency. 


Two reviews this year — the review of certain foreign signals 
intelligence activities and the review of CSEC assistance to CSIS 
under part (c) of CSEC’s mandate and sections 12 and 21 of the 
Canadian Security Intelligence Service Act (CSIS Act) — identified 
the absence of certain historical information in a CSEC system and 
database relating to foreign signals intelligence collection. This system 
and database support the process by which CSEC determines that 
entities of foreign intelligence interest are indeed foreign and located 
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outside of Canada, as required by the National Defence Act. The 
absence of the information limited my ability to assess the lawfulness 
of the CSEC activities in question, and could also affect review of 
other activities of CSEC. Due to the seriousness of this development, 
I directed my employees to conduct an in-depth examination of the 
issue to determine the implications and advise on a resolution. This 
issue added to the time required to complete these two reviews. It is 
encouraging that CSEC has already taken action and continues to do 
so to ensure the availability of information that is required for 
accountability and to demonstrate compliance with the law. The 
Commissioner’s office will monitor developments. 


In last year’s annual report, I expressed frustration about a reduction in 
CSEC support to my office resulting in excessive delays in being able to 
proceed with some reviews. CSEC has taken steps to correct this situation 
and I am optimistic that these will result in a productive year ahead. 
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HIGHLIGHTS OF THE SIX REVIEWS SUBMITTED TO 
THE MINISTER IN 2012-2013 


1. Review of certain foreign signals intelligence 
activities 


Background 

I examined CSEC’s acquisition, use and exchange of information 
relating to certain foreign intelligence activities that occurred a number 
of years ago. 


Findings and recommendations 

I had no concern with respect to the majority of the CSEC activities 
reviewed. However, a small number of records suggested the possibility 
that some activities may have been directed at Canadians, contrary to 
law. A number of CSEC records relating to these activities were unclear 
or incomplete. After in-depth and lengthy review, I was unable to reach a 
definitive conclusion about compliance or non-compliance with the law. 


In the process of review, I found that a number of CSEC records relating 
to exchanges of information with CSIS were sometimes unclear, which 
led me to recommend that CSEC promulgate policy guidance respecting 
how to clearly and consistently communicate with its partners about 
what entity the activities are being directed at. As well, I recommended 
that CSEC ensure that its foreign intelligence analysts are 
knowledgeable about and follow existing policy guidance, introduced 
since the period under review, respecting their responsibilities for 
determining the foreign status of an entity and the justifications for 
directing activities at that entity. Following the completion of my review, 
I forwarded to the Chair of SIRC, for information, certain general points 
relating to CSIS that arose out of the recommendations I made. 
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At my direction, my office has started a review of other more recent 
foreign intelligence activities that includes follow-up on matters raised 
in this review, and will seek to determine whether developments in 
CSEC policies and procedures since the period under review have led to 
an improvement in the clarity of language in CSEC information 
exchanges with CSIS. 


Conclusion 

As of the end of the 2012-2013 reporting period, March 31, 2013, Iam 
awaiting the Minister’s response to the two recommendations. The 
responses will be noted in next year’s annual report. 


2. CSEC assistance to CSIS under part (c) of 
CSEC’s mandate and sections 12 and 21 of 
the CSIS Act 


Background 

In 2007, CSIS sought from the Federal Court of Canada a warrant to 
assist in the investigation of threat-related activities that, it was believed, 
individuals would engage in while travelling outside of Canada. The 
Honourable Justice Edmond Blanchard held that the Court lacked the 
Jurisdiction to authorize intrusive investigative activities by CSIS 
employees outside of Canada (Re CSIS Act, 2008 FC 301). 


In 2009, in X(Re), 2009 FC 1058, the Court was asked to revisit the 
question of jurisdiction and to distinguish Justice Blanchard’s reasoning 
on the basis of a more complete description of the facts relating to the 
activities necessary to permit the interception and a different legal 
argument concerning how the method of interception was relevant to the 
jurisdiction of the Court. The Honourable Justice Richard Mosley was 
satisfied that there were sufficient factual and legal grounds to 
distinguish the application from that which was before Justice Blanchard 
and he issued the first warrant permitting CSIS to intercept the 
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communications of Canadians located outside Canada using the 
interception capabilities of CSEC. The application was supported by the 
affidavit evidence of an employee of CSEC that described the agency’s 
interception capabilities and how communications would be intercepted 
from within Canada. 


Paragraph 273.64(1)(c) of the National Defence Act authorizes CSEC 
to provide technical and operational assistance to federal law 
enforcement and security agencies in the performance of their lawful 
duties. This assistance includes CSEC supporting CSIS with the 
interception of Canadians’ communications if CSIS has a judicially 
authorized warrant issued under section 21 of the CS/S Act. Pursuant 
to subsection 273.64(3) of the National Defence Act, CSEC is subject 
to any limitations imposed by law on the agency to which it is 
providing assistance — for example, any conditions imposed by a 
judge in a warrant. When CSEC provides operational assistance to 
CSIS, CSEC becomes the agent of CSIS. CSIS is de jure the owner of 
the information and the intercepted communications relating to the 
subject of the warrant. 


In X(Re), Justice Mosley stated: 


Canada has given CSE[C] a mandate to collect foreign 
intelligence including information from communications and 
information technology systems and networks abroad. It [CSEC] 
is restricted as a matter of legislative policy from directing its 
activities against Canadians or at any person within Canada, but 
it is not constrained from providing assistance to security and 
law enforcement agencies acting under lawful authority such as 
a judicial warrant. CSIS is authorized to collect threat-related 
information about Canadian persons and others and, as 
discussed above, is not subject to territorial limitation. 


Where the statutory prerequisites of a warrant are met, including 


prior judicial review, reasonable grounds and particularization of 
the targets, the collection of the information by CSIS with 
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CSE[C] assistance, as proposed, falls within the legislative 


scheme approved by Parliament and does not offend the Charter. 


(X(Re) at paragraphs 75-76) 


The objectives of my review were to acquire detailed knowledge of and 
to document CSEC’s assistance to CSIS and to assess whether CSEC 
activities complied with the law, including with the terms of the warrants 
issued to CSIS, and any privacy protections found therein. CSEC’s 
assistance to CSIS under the warrants may include use of Canadian 
identity information and the interception of the communications of 
Canadians. CSEC’s collection, as defined in the warrant, may impact on 
the privacy of Canadians. 


I examined CSEC assistance to CSIS in support of a number of the first 
warrants of this kind relating to counter-terrorism. Specifically, as part 
of assessing compliance with the law and privacy protection, for the 
warrants examined, I verified that: 


¢ CSEC had a copy of the warrant and had clear and sufficient 
information about the assistance sought by CSIS; 


¢ the communications targeted by CSEC for CSIS were only those 
communications referred to in the warrants; 


¢ the communications were not targeted before the warrants came 
into force and were no longer targeted once the warrants expired; 


¢ CSEC targeted the subjects of the warrants only while they were 
believed to be outside Canada; 


+ CSEC targeted only the types of communications and information 


that were authorized in the warrants to be intercepted or obtained; and 


+ CSEC complied with any other limitations imposed by law on 
CSIS, for example, any conditions in the warrants. 
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Findings and recommendations 

During the period under review, CSEC responded appropriately to two 
related privacy incidents it identified involving the unintentional release 
of Canadian identity information of some of the subjects of the warrants. 
In fact, CSEC has already clarified appropriate internal processes for the 
conduct of certain activities and reminded its employees of their 
information stewardship responsibilities. This should help prevent 
similar incidents. 


I questioned CSEC about another incident involving the interception of 
communications for CSIS for a small number of days after a particular 
warrant had expired. I accepted CSEC’s explanation for this incident, 
which was that it resulted from unintentional human error. CSEC also 
confirmed that these intercepted communications were destroyed and 
that CSIS did not receive them. I am satisfied that CSEC documented 
this incident and reminded its employees of proper process to help 
prevent similar errors. 


During the period under review, operational policies and procedures of 
general application to CSEC’s assistance in support of these warrants 
and related activities were in place and provided direction to CSEC 
employees respecting compliance with the law and the protection of the 
privacy of Canadians. Subsequent to the period under review, CSEC 
issued specific guidance for the conduct of this assistance and activities. 
Generally, CSEC employees interviewed were well aware of the policies 
and procedures and demonstrated knowledge of their respective 
responsibilities. Interviews with CSEC managers, team leaders and other 
employees showed that managers routinely monitored the assistance and 
related activities for compliance with governing authorities. 


In addition to a detailed examination of CSEC activities under the 
warrants, I considered and consulted my independent counsel, who is 
also a privacy law expert, on general questions of law relating to this 
subject. I made two recommendations to the Minister to help ensure 
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CSEC assistance to CSIS is consistent with the authorities and 
limitations of the warrants, and to enhance the measures in place to 
protect the privacy of Canadians. Specifically, I recommended that: 


1. CSEC discuss with CSIS the expansion of an existing 
practice to protect privacy to other circumstances; and 


2. CSEC advise CSIS to provide the Federal Court of Canada 
with certain additional evidence about the nature and extent 
of the assistance CSEC may provide to CSIS. 


I found that CSEC practices relating to its assistance to CSIS and related 
activities were consistent with the general requirements in the 
“Accountability Framework” and “Privacy of Canadians” ministerial 
directives to CSEC, specifically to comply with the law and to take 
measures to ensure that information was lawfully obtained and handled 
in a manner consistent with the Canadian Charter of Rights and 
Freedoms and the Privacy Act. 


Conclusion 

While I made two recommendations to the Minister to help ensure 
CSEC assistance to CSIS is consistent with the law and to enhance 
privacy protection, I concluded that CSEC conducted its activities in 
accordance with the law and ministerial direction, and in a manner that 
included measures to protect the privacy of Canadians. The Minister 
accepted and CSEC has addressed the recommendations. 


Following the completion of my review, I forwarded to the SIRC Chair, 
for information, certain general points relating to CSIS that arose out of 
the two recommendations I made and that SIRC may wish to examine as 
it deems appropriate. Subsequently, CSEC advised me that it raised the 
recommendations — which relate to matters that are controlled by CSIS, 
or require agreement from CSIS — with CSIS. 
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3. Review of CSEC IT security activities not 
conducted under a ministerial authorization 


Background 

The National Defence Act mandates CSEC to provide advice, guidance 
and services to Government of Canada departments and agencies as well 
as to other owners of IT systems to help ensure the protection of 
electronic information and of information infrastructures of importance 
to the Government of Canada (paragraph 273.64(1)(b)). 


During the period under review, the Government of Canada reorganized 
its cyber defence efforts. CSEC became the primary point of contact for 
cyber incidents faced by Government of Canada departments and 
agencies. Public Safety Canada is the primary point of contact for cyber 
incidents affecting non-Government of Canada critical infrastructure 
sectors. A further distinction is that CSEC is responsible for 
sophisticated cyber threats, such as those stemming from foreign state 
actors, while Public Safety Canada responds to less sophisticated threats, 
for example, those relating to known vulnerabilities in commercially 
available computer software. 


I examined certain IT security activities conducted by CSEC to detect, 
analyse and mitigate cyber threats. CSEC does not undertake these 
activities under a ministerial authorization as it does not intercept 
communications. Rather, CSEC uses information acquired by the system 
owners — under their Criminal Code authorities and, for Government of 
Canada system owners, also under their Financial Administration Act 
authorities — and disclosed to CSEC. These authorities permit the 
interception of private communications by authorized persons when the 
interception is reasonably necessary to protect computer systems from 
mischief and unauthorized use. 
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The objectives of my review were to assess whether CSEC complied 
with the law and the extent to which CSEC protected the privacy of 
Canadians in carrying out the activities. In addition to acquiring detailed 
knowledge about the activities, I examined: 


¢ the legislative and policy framework for the activities; 
+ CSEC organizational changes; 
¢ technologies, databases and systems used for the activities; 


¢ the amount and treatment of private communications and 
Canadian identity information acquired by the activities as well as 
a sample of those private communications and Canadian identity 
information used by CSEC; and 


* agreements in place with Government of Canada departments and 
agencies. 


Private Communication: ‘any oral communication, or any 
telecommunication, that is made by an originator who is in Canada or is 
intended by the originator to be received by a person who is in Canada 
and that is made under circumstances in which it is reasonable for the 
Originator to expect that it will not be intercepted by any person other than 


the person intended by the originator to receive it, and includes any radio- 
based telephone communication that is treated electronically or otherwise 
for the purpose of preventing intelligible reception by any person other than 
the person intended by the originator to receive it” (section 183 of the 
Criminal Code). 


I examined activities conducted between April 1, 2009, and 

March 31, 2011, including a more detailed examination of activities 
and associated reporting for a number of the departments and agencies 
assisted by CSEC during that time. Additionally, records were examined 
to verify that system owner information retained by CSEC was done so 
under an appropriate legal authority. My review also included an 
examination of CSEC’s responses to areas for follow-up identified in a 
2009 study by former Commissioner Gonthier. 
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Findings 

I found that CSEC conducted its activities in accordance with the law 
and ministerial direction and I had no questions about the reporting and 
retained information examined. 


I suggested that CSEC could enhanse its ability to demonstrate that it 
has measures to protect the privacy of Canadians by recording the return 
or deletion of irrelevant information acquired by a system owner and 
shared with CSEC. Notwithstanding this suggestion, I found that these 
IT security activities contained satisfactory measures to protect the 
privacy of Canadians. 


During the period under review, operational policies and procedures 
of general application were in place to provide general direction 
respecting compliance with the law and the protection of privacy of 
Canadians. However, there was no specific operational guidance in 
place for these activities. It is a positive development that, subsequent 
to the period under review, CSEC issued a specific policy for the 
conduct of these activities. 


Some CSEC employees who were interviewed were unable to cite 
certain policies, but were aware of the rules governing their activities. In 
addition, CSEC managers who were interviewed routinely and closely 
monitored the activities to ensure that their employees complied with 
governing authorities. Based on the records examined, the answers 
provided to questions during interviews and CSEC’s policy compliance 
validation activities, the activities reviewed complied with relevant 
policies and procedures. 


Conclusion 

My review report contained no recommendations. However, regular in- 
depth reviews will continue to be conducted of IT security activities not 
conducted under a ministerial authorization to verify compliance with 
the law, and the extent to which CSEC protects the privacy of Canadians 
in carrying out the activities. 
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4. Review of CSEC’s 2010-2011 and 2011-2012 
foreign signals intelligence ministerial 
authorizations 


Background 

Subsection 273.65(8) of the National Defence Act requires the 
Commissioner to review CSEC activities carried out under ministerial 
authorizations “to ensure they are authorized and report annually to the 
Minister [of National Defence] on the review.” A regular combined 
review of the foreign signals intelligence ministerial authorizations is 
one way that Commissioners fulfill this part of their mandate. This 
year’s review covered two fiscal years: I examined the five foreign 
signals intelligence ministerial authorizations in effect from 
December 1, 2010, to November 30, 2011, relating to five activities 
or classes of activities, as well as the six foreign signals intelligence 
ministerial authorizations in effect from December 1, 2011, to 
November 30, 2012, relating to six activities or classes of activities. 
The purpose of this review was to: 


1. ensure that the activities conducted under the ministerial 
authorizations were authorized and that the Minister 
was satisfied that the four conditions for authorization 
required by paragraphs 273.65(2)(a) to (d) of the 
National Defence Act were met; 


2. identify any significant changes to the ministerial 
authorization documents themselves or to CSEC’s 
activities described in the ministerial authorizations; 


3. assess the impact, if any, of these changes on the risk of 
non-compliance and on the risk to privacy, and, as a result, 
identify any subjects requiring follow-up review; and 
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4. examine, for compliance with the law, a sample of my 
choosing of any resulting private communications 
unintentionally intercepted by CSEC while conducting 
foreign signals intelligence collection activities under the 
ministerial authorizations. 


Private communications 


The Commissioner monitors the number of private communications 


unintentionally intercepted and verifies how CSEC treated and used these 
communications. The Commissioner is able to review all of the private 
communications that CSEC uses and retains. 


30 


Findings 

I found that the activities conducted under the 2010-2011 and the 
2011-2012 foreign signals intelligence ministerial authorizations were 
authorized. 


For each of the 11 foreign signals intelligence collection activities, I 
examined certain key information relating to interception and to the 
privacy of Canadians, to permit comparison of the activities and to 
identify any significant changes or trends over time. I found no 
significant changes to the scope or operation of any of the activities to 
require a follow-up in-depth review of specific activities. The 
2010-2011 and 2011-2012 foreign signals intelligence ministerial 
authorizations did not contain any significant changes from the previous 
year and CSEC did not make any significant changes to the technologies 
used for these activities. 


Changes made by CSEC in 2010-2011 and in 2011-2012 to its 
operational policies for foreign signals intelligence collection activities 
clarified authorities and practices and enhanced the protection of the 
privacy of Canadians. 
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I also reviewed a sample of unintentionally intercepted private 
communications that CSEC recognized and retained, and that CSEC 
did not use in its reports. I found that in both 2010-2011 and 
2011-2012, CSEC retained only those private communications 
essential to international affairs, defence or security, as required by 
paragraph 273.65(2)(d) of the National Defence Act. Again this year, 
the proportion of these communications remained very small and 
CSEC destroyed most of them. In addition, a new tool is being 
developed that will assist CSEC analysts in identifying intercepted 
communications that might be private communications. The 
Commissioner’s office will examine the impact of this new tool on 
compliance and privacy protection in a future review. 


In last year’s report, I indicated that certain information about 
intercepted communications involving CSEC’s international partners 
was not readily available. It is positive that, while not a requirement in 
the ministerial authorizations, CSEC has recognized the importance of 
reporting this information to the Minister. The Commissioner’s office 
will monitor developments. 


It is also a positive development that, while not a requirement of a 
particular ministerial authorization, CSEC has agreed to report to the 
Minister certain information relating to privacy. This measure to protect 
the privacy of Canadians will support the Minister in his accountability 
for CSEC. It also satisfies an outstanding recommendation I made in 
2010-2011. The Minister had initially supported CSEC’s rejection of 
this recommendation. However, after further examination, I maintained 
my recommendation and so informed the Minister. CSEC reconsidered 
its initial position and advised the Minister that it would undertake to 
implement the recommendation. 


Conclusion 
I made no recommendations. 
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5. Annual review of a sample of disclosures 
of Canadian identity information to 
Government of Canada clients 


Background 

Canadian identity information may be included in CSEC’s foreign 
signals intelligence reports if it is required to understand or use the 
foreign intelligence. However, any information that identifies a 
Canadian must be suppressed in the reports — that is, replaced by a 
generic reference such as “a named Canadian.” When receiving a 
subsequent request for disclosure of the details of the suppressed 
information, CSEC must verify that the requesting client has both the 
authority and operational justification for obtaining the Canadian 
identity information. Only then may CSEC provide that information. 


My officials selected and examined a sample of approximately 20 percent 
of the total number of disclosures by CSEC to Government of Canada 
agencies or departments during the period October 2011 to June 2012. 

The sample included disclosures made to all of the departments that had 
requested Canadian identity information during the period under review. 
My officials examined: the requests documenting the clients’ authority and 
justification for obtaining the Canadian identity information; associated 
CSEC foreign signals intelligence reports; and the actual disclosures of 
Canadian identity information. 


Findings 

Based on my assessment of the information reviewed and the interviews 
conducted, CSEC conducted its disclosure activities in compliance with 
the law. Operational policies and procedures are in place and provide 
sufficient direction to CSEC employees respecting the protection of the 
privacy of Canadians. CSEC employees were knowledgeable about, and 
acted in accordance with, the policies and procedures. 
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In addition, in response to a recommendation made by former 
Commissioner Cory in his 2010 report, in 2012, CSEC started using a 
new on-line secure system to process requests for and disclosures of 
Canadian identity information. CSEC provided my employees with a 
demonstration of the system, which is currently used with CSEC’s 
principal clients. CSEC intends to extend its use to other partners 
starting in the coming fiscal year. According to CSEC, the system has 
improved the timeliness of responses and resulted in better service to 
its clients. It enhances accountability by improving the tracking and 
retrieval of requests for and disclosures of Canadian identity 
information and it contains a number of features to help ensure the 
protection of the privacy of Canadians. 


Conclusion 

My review did not result in any recommendations. CSEC conducted its 
disclosure activities in a thorough manner; all of the requests reviewed 
were authorized, justified and well documented. 


Should there be an instance of non-compliance in CSEC disclosure of 
Canadian identity information, the potential impact on the privacy of 
Canadians could be significant. For this reason, annual reviews of a 
sample of disclosures will continue. Next year’s sample will include a 
detailed examination of the use of the new system, as well as a sample 
of disclosures of Canadian identity information to CSEC’s 
international partners. 
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6. Annual review of incidents and procedural 
errors identified by CSEC in 2012 that 
affected or had the potential to affect the 
privacy of Canadians and measures taken 
by CSEC to address them 


Background 

CSEC maintains a central file describing any operational incidents 
that did or could have an impact on the privacy of Canadians. CSEC 
records in this file any incidents it identifies that put at risk the 
privacy of a Canadian in a manner that runs counter to or is not 
provided for in its operational policies. CSEC policy requires its 
foreign signals intelligence and IT security employees to report and 
document privacy incidents in order to demonstrate compliance with 
legal requirements and CSEC policies, and to prevent further 
incidents. Incidents could include, for example, the inadvertent 
inclusion of Canadian identity information in a report, or mistakenly 
sharing a report with the wrong recipient. 


Horizontal and in-depth reviews of CSEC activities include an 
examination of any privacy incidents and procedural errors relating to 
the subject under review and, where appropriate, are reported in the 
summaries of those reviews. My employees are vigilant during reviews 
about identifying these types of incidents, so we can confirm whether 
CSEC also identified and addressed them. 


The objectives of this annual review are to: acquire knowledge of the 
incidents and procedural errors in 2012 and associated actions; and 
inform development of the Commissioner’s work plan, by determining if 
there are any systemic issues or issues about compliance with the law or 
the protection of the privacy of Canadians that should be the subject of 
follow-up review. The review of these privacy incidents and procedural 
errors also assists in evaluating how CSEC monitors and validates that 
its activities adhere to its operational policies. 
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Findings 

I examined all foreign signals intelligence and IT security privacy 
incidents and procedural errors recorded by CSEC in calendar year 
2012, and the subsequent actions taken by CSEC to correct them. 


There was a very small number of procedural errors and I agreed with 
CSEC’s assessment that these occurrences were minor and did not 
amount to privacy incidents. 


Based my review of CSEC’s records as well as independent verification 
by my office of reports in a CSEC database, I am satisfied that CSEC 
took appropriate corrective actions in response to the small number of 
privacy incidents it recorded. 


I was particularly pleased with certain remedial actions taken by CSEC 
to prevent future similar privacy incidents. For example, CSEC is now 
conducting a monthly review of its central file to ensure that all required 
remedial activities have been completed or are being pursued. As well, 
CSEC reminded its employees of the requirement to report an incident 
immediately. CSEC also established a process to send reminders to its 
employees to make sure that certain information in its systems is up to 
date and compliant with existing authorities. 


Conclusion 

My review of the privacy incidents and procedural errors identified by 
CSEC in 2012 did not result in any recommendations. My review did 
not reveal any systemic deficiencies or issues that require follow-up 
review. Annual reviews will continue to be conducted of the privacy 
incidents and procedural errors identified by CSEC. 
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COMPLAINTS ABOUT CSEC ACTIVITIES 


In 2012-2013, my office was contacted by a number of individuals who 
were seeking information or expressing concern about CSEC activities. 
However, the inquiries were assessed as outside of the Commissioner’s 
mandate or as lacking credibility. No complaints about CSEC activities 
warranted investigation by the Commissioner. (More information on the 
complaints process is available on the office’s website.) 


DUTY UNDER THE SECURITY OF INFORMATION ACT 


I have a duty under the Security of Information Act to receive 
information from persons who are permanently bound to secrecy seeking 
to defend the release of special operational information — such as 
certain information relating to CSEC activities — on the grounds that it 
is in the public interest. No such matters were reported to me in 
2012-2013. (More information on the Commissioner’s responsibilities 
under the Security of Information Act is available on the office’s website.) 


ACTIVITIES OF THE COMMISSIONER’S OFFICE 


In last year’s annual report, in an attempt to clarify misconceptions and to 
better inform the public about CSEC’s and my mandates and activities, I 
provided more detail than ever before on CSEC’s activities, what 
Commissioners review, how reviews are carried out, and the impact of 
reviews. Work is ongoing to improve the website, which contains detailed 
information on the activities of the Commissioner’s office. Of course, the 
Commissioner provides the Minister of National Defence with additional 
classified information — which cannot be disclosed in this public report 
or on the website — so that the Minister can be fully aware of the 
Commissioner’s review of CSEC activities. Last year, employees of my 
office and I also met with a number of academics and other professionals 
interested in review of security and intelligence agencies to talk about my 
role and work and their views on effective review. In addition, my office 
made presentations to five cohorts of new CSEC employees attending 
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CSEC’s foundational learning course, which is a requirement for every 
new employee. These presentations provide an introduction to what it is I 
and my office do, how we go about our work, and how it may affect them 
as CSEC employees. 


During the past year, CSEC provided a number of detailed briefings to 
employees of my office as part of the conduct of reviews. CSEC also 
provided an overview briefing on recent and important operational, 
policy and organizational changes and issues. I attended an interactive 
presentation that demonstrated CSEC’s foreign signals intelligence 
capabilities and response to an incident. The event was very effective in 
demonstrating how the many different parts of CSEC, many personnel 
and many different government departments and agencies cooperate, in 
response to a top Government of Canada priority. I was struck by the 
knowledge and professionalism of CSEC employees and their evident 
dedication to their respective responsibilities. In addition, my employees 
attended CSEC training on foreign signals intelligence activities and on 
communications security. 


Following a conference on security and privacy at the Université de 
Montréal in October 2011, my office’s Executive Director wrote a 
chapter in a book, Circulation internationale de l'information et sécurité 
published in late 2012. The chapter was based on his participation in 

one of the conference panels, describing distinctions between national 
security and public safety, the role and impact of review, and the 
integration of technology and privacy protection in national security. 


At the beginning of March, the Executive Director delivered a luncheon 
address at the 15" annual conference organized by the Centre for Military 
and Strategic Studies at the University of Calgary, with the theme Global 
Security: Past, Present and Future. His address dealt with the role of 
intelligence review, focussing on four questions: why is review 
important; how effective can it be and what makes for effective review; 
what is the view of the intelligence agencies themselves concerning 
review; and what of the future and some challenges. 
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WORK PLAN — REVIEWS UNDER WAY AND 
PLANNED 


Commissioners use a risk-based and preventative approach to reviews. 
A three-year work plan is updated twice a year. Developing the work 
plan draws on many sources. Two important ones are regular briefings 
from CSEC on new activities and changes to existing activities, and 

the Chief of CSEC’s classified annual reports to the Minister of 
National Defence on CSEC’s priorities and legal, policy and management 
issues of significance. 


The results of several reviews currently under way are expected to be 
reported to the Minister of National Defence in the coming year and 
included in my successor’s 2013-2014 annual report. The subjects of 
these reviews include: CSEC counter-terrorism activities; a follow-up to 
this year’s review of certain foreign signals intelligence activities; 
CSEC’s policy compliance validation framework and activities; and a 
review of particular signals intelligence collection activities conducted 
under ministerial authorizations. 


In addition, before the end of my term as Commissioner, I will report to 
the Minister on my ongoing review of CSEC’s foreign signals intelligence 
sharing with its closest international partners — the United States’ 
National Security Agency, the United Kingdom’s Government 
Communications Headquarters, the Australian Defence Signals 
Directorate and the New Zealand Government Communications Security 
Bureau. CSEC and its international partners respect each other’s laws by 
pledging not to direct collection activities at one another’s citizens’ 
communications. CSEC is prohibited from requesting an international 
partner to undertake activities that CSEC itself is legally prohibited from 
conducting. However, CSEC sharing information with its international 
partners could affect a Canadian; it is in the international sharing of 
personal information where the risks are higher than for sharing involving 
domestic partners. My 2011—2012 annual report contained an update on 
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this review. This year, I continued my in-depth review and consulted my 
independent counsel on general questions of law relating to this subject. 


Some of the reviews planned for 2013-2014, which may carry over to 
the next year, are: a review of CSEC IT security activities conducted 
under ministerial authorizations in support of Government of Canada 
efforts to address cyber threats; a follow-up review of CSEC activities 
carried out under a ministerial directive for the purposes of identifying 
new foreign entities believed to be of foreign intelligence interest; and a 
follow-up review of CSEC efforts to address numerous gaps related to 
CSEC’s dealings with the Canadian Armed Forces, as identified by 
CSEC internal evaluators. In addition, the office plans to continue the 
annual reviews of: (1) foreign signals intelligence ministerial 
authorizations; (2) CSEC disclosures of Canadian identity information; 
and (3) privacy incidents and procedural errors identified by CSEC and 
the measures subsequently taken by CSEC to address them. The office 
will work with my successor to put in place a comprehensive work plan 
soon after his or her appointment. 


IN CLOSING 


The position of Commissioner is a legislated part of how the government 
decided, in enacting the National Defence Act, to strike a balance 
between — on the one hand — the Government of Canada’s need for 
foreign signals intelligence and IT security services, and — on the other 
hand — the need to protect the privacy of Canadians. 


The role of the Commissioner and the Commissioner’s office is to be 
sceptical and critical of CSEC activities and it is natural that our 
respective organizations may sometimes disagree. However, we have a 
shared objective with CSEC, which is to ensure CSEC complies with the 
law and protects the privacy of Canadians in the conduct of its activities. 
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The fulfillment of the Commissioner’s mandate rests on the integrity of 
the office, its ability to effect change at CSEC and inspire confidence in 
the public that CSEC is under rigorous review. 


Finally, I thank the staff of my office, whose dedication, enthusiasm, 
teamwork, rigour and sense of duty have been nothing short of 
remarkable these past three years. I can say with pride and confidence 
that CSEC is truly being watched. 
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ANNEX A: COMMISSIONER’S OFFICE REVIEW PROGRAM — 
LOGIC MODEL 


Plan, conduct and report on reviews 


and studies of CSEC’s activities 


Notifications to Minister 
of National Defence and 
Attorney General of any 


Reports to Minister of 
National Defence 
and CSEC 


Annual reports to 
Minister of National 
Defence for tabling 


- assurance in Parliament: CSEC activity that may 

- information - assurance not be in compliance with 
- findings - information the law 

- recommendations 


CSEC activities based 
on sound policies, 
procedures and 
practices 


| Support for 
Minister of National 
Defence in his/her 
| accountability for 
=) CSEC 


CSEC accepts and 
implements advice and 
recommendations 


(immediate) 


OUTCOMES 


Low CSEC susceptibility to, and 
incidence of, lack of compliance 
with the law; high level of 
safeguarding privacy 


Government and public confidence in the 
lawfulness of CSEC’s activities 
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ANNEX B: EXCERPTS FROM THE NATIONAL DEFENCE ACT 
AND THE SECURITY OF INFORMATION ACT RELATED TO THE 
COMMISSIONER’S MANDATE 


National Defence Act — Part V.1 
Appointment of Commissioner 


273.63 (1) The Governor in Council may appoint a supernumerary judge or a retired 
judge of a superior court as Commissioner of the Communications Security 
Establishment to hold office, during good behaviour, for a term of not more 
than five years. 


Duties 
(2) The duties of the Commissioner are 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any 
activity of the Establishment that the Commissioner believes may not be 
in compliance with the law. 


Annual report 


(3) The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities and 
findings, and the Minister shall cause a copy of the report to be laid before 
each House of Parliament on any of the first 15 days on which that House is 
sitting after the Minister receives the report. 
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Powers of investigation 


(4) In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the /nquiries Act. 


Employment of legal counsel, advisors, etc. 


(5) The Commissioner may engage the services of such legal counsel, technical 
advisers and assistants as the Commissioner considers necessary for the 
proper performance of his or her duties and, with the approval of the 
Treasury Board, may fix and pay their remuneration and expenses. 


Directions 


(6) The Commissioner shall carry out such duties and functions as are assigned 
to the Commissioner by this Part or any other Act of Parliament, and may 
carry out or engage in such other related assignments or activities as may be 
authorized by the Governor in Council. 


er 
Review of authorizations 
273.65 (8) The Commissioner of the Communications Security Establishment shall review 


activities carried out under an authorization issued under this section to ensure 
that they are authorized and report annually to the Minister on the review. 
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Security of Information Act 


Public interest defence 


15. (1) No person is guilty of an offence under section 13 or 14 if the person establishes 
that he or she acted in the public interest. [...] 


Prior disclosure to authorities necessary 


(5) A judge or court may decide whether the public interest in the disclosure 
outweighs the public interest in non-disclosure only if the person has complied 
with the following: [...] 


(5) the person has, if he or she has not received a response from the deputy head 
or the Deputy Attorney General of Canada, as the case may be, within a 
reasonable time, brought his or her concern to, and provided all relevant 
information in the person’s possession to, [...] 


(ii) the Communications Security Establishment Commissioner, if the 
person’s concern relates to an alleged offence that has been, is being or 
is about to be committed by a member of the Communications Security 
Establishment, in the purported performance of that person’s duties and 
functions of service for, or on behalf of, the Communications Security 
Establishment, and he or she has not received a response from the 
Communications Security Establishment Commissioner within a 
reasonable time. 
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ANNEX C: 2012-2013 STATEMENT OF EXPENDITURES 


Standard Object Summary ($) 


Salaries and Benefits 907,567 
Transportation and Telecommunications 15,412 
Information 59,131 
Professional and Special Services 305,572 
Rentals 217,803 
Repairs and Maintenance eyes 
Material and Supplies 10,383 
Machinery and Equipment 16,985 
Capital Assets, including Leasehold Improvements 751,350 
Total 2,285,718 
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